All Apps and Add-ons

Splunk DB connect not loading data using Splunk_TA mcafee add on

RK_sp1unk
New Member

Issue:Splunk DB connect not loading data using Splunk_TA mcafee add on

connection:mcafee_epo_5_db

DB connect version:3.1

it connects to DB but no details are pulled from configured table

did searched index=mcafee sourcetype=mcafee:epo but no data ...how to resolve the same..

0 Karma

RK_sp1unk
New Member

we did test the DB connection is fine , also most of the queries are giving results but older results like of nov 2019 not of feb 2020

check point value is blank

also |tstats count where index=mcafee by sourcetype when i search this using normal search no results

also using the DB connect app no results

what needs to be checked else to resolve this issue

how can i check if there is a table permission issue , user says queries used to run and fetch the data automatically

connection is mcafee_epo_5_db

table name is "eP04_VAVSRV01"alt text

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Are you searching within the context of the dbconnect app, or from the more general search app context? Context makes a big difference when it comes to sourcetypes. If the latter, you'll have to update props.conf in the search app dir to include the sourcetype you're referencing.

e.g.
https://xx.xxx.xx.xx:8000/en-US/app/splunk_app_db_connect/search?q=search

vs
https://xx.xxx.xx.xx:8000/en-US/app/search/search?q=search?q=search

One easy method to verify sourcetypes within a index is to use the following:

|tstats count where index=mcafee by sourcetype
----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

adalbor
Builder

Have you tested your query in DB Connect to make sure it is correct?
If it doesn't return any results then you either have an issue with the query, permissions to the table, or the connection to the db.

0 Karma

RK_sp1unk
New Member

yes i have tested the connection to be fine , but for few tables the query is not fecthing any results for few tables it is not giving the latest details like for the last week also for last week we get no data
how can we check if the data is getting ingested

0 Karma

RK_sp1unk
New Member

it gives no results or data what next can be checked

0 Karma

RK_sp1unk
New Member

which logs and what exactly what you want me to check

0 Karma

adalbor
Builder

Well I would start by running a search index=_internal host=whateverhostrunsdbconnect log_level IN (WARN,ERROR)

0 Karma

adalbor
Builder

I would recommend you start by looking through your _internal logs for the host you have running DBConnect. Look for any specific errors related to your query or even the credentials you might be using to connect.

0 Karma

tomasmoser
Contributor

Check "Checkpoint Value" under DB Inputs & lower the value. I then started getting data.

0 Karma

RK_sp1unk
New Member

Any other scenarios we can check

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...