Splunk DB connect not loading data using Splunk_TA mcafee add on

[RK_sp1unk]

Issue:Splunk DB connect not loading data using Splunk_TA mcafee add on

connection:mcafee_epo_5_db

DB connect version:3.1

it connects to DB but no details are pulled from configured table

did searched index=mcafee sourcetype=mcafee:epo but no data ...how to resolve the same..

[RK_sp1unk]

we did test the DB connection is fine , also most of the queries are giving results but older results like of nov 2019 not of feb 2020

check point value is blank

also |tstats count where index=mcafee by sourcetype when i search this using normal search no results

also using the DB connect app no results

what needs to be checked else to resolve this issue

how can i check if there is a table permission issue , user says queries used to run and fetch the data automatically

connection is mcafee_epo_5_db

table name is "eP04_VAVSRV01"

[codebuilder]

Are you searching within the context of the dbconnect app, or from the more general search app context? Context makes a big difference when it comes to sourcetypes. If the latter, you'll have to update props.conf in the search app dir to include the sourcetype you're referencing.

e.g.
https://xx.xxx.xx.xx:8000/en-US/app/splunk_app_db_connect/search?q=search

vs
https://xx.xxx.xx.xx:8000/en-US/app/search/search?q=search?q=search

One easy method to verify sourcetypes within a index is to use the following:

|tstats count where index=mcafee by sourcetype

[adalbor]

Have you tested your query in DB Connect to make sure it is correct?
If it doesn't return any results then you either have an issue with the query, permissions to the table, or the connection to the db.

[RK_sp1unk]

yes i have tested the connection to be fine , but for few tables the query is not fecthing any results for few tables it is not giving the latest details like for the last week also for last week we get no data
how can we check if the data is getting ingested

[RK_sp1unk]

it gives no results or data what next can be checked

[RK_sp1unk]

which logs and what exactly what you want me to check

[adalbor]

Well I would start by running a search index=_internal host=whateverhostrunsdbconnect log_level IN (WARN,ERROR)

[adalbor]

I would recommend you start by looking through your _internal logs for the host you have running DBConnect. Look for any specific errors related to your query or even the credentials you might be using to connect.

[tomasmoser]

Check "Checkpoint Value" under DB Inputs & lower the value. I then started getting data.

[RK_sp1unk]

Any other scenarios we can check