Splunk DBConnect | change ports after each daemon restart 9995 9998 | version 9.0.5

[NullZero]

I'm a Splunk PS consultant working with a client on a greenfield build, S1 SVA. They want to connect to an Oracle database and we have installed DBConnect and Java etc. After some JRE / JVM version troubleshooting and environment path challenges, it all works fine and can interrogate the Oracle instance.

Problem:

• After each Splunk reload the DB connect fails
• This is due to the port allocation and can be fixed by manually changing it from 9998 to 9995 for example in the GUI and saving
• This requires manual intervention each time which is not sustainable
• The port saves in /opt/splunk/etc/apps/splunk_app_db_connect/jars/<file>.vmopts

Has anybody else experienced this please? It's unclear if this is related to the a path variable for Java or some sort of locking and it not being able to reuse the port post daemon reload.

[isoutamo]

Hi

I haven't heard/seen such a strange thing before.

Are you using common/alternate  path to JAVA_HOME or version dependent? It shouldn't affect now but after version update it could.

Have you try to edit that *.vmopts files when splunk (and that java instances too) is down and it still change that port definition?

r. Ismo

[NullZero · Accepted solution]

We resolved the issue. In the UI all four ports were set to the same, this functioned fine and saved, but what we could see happening on Splunkd restart was that the processes were trying to obtain the same port. We set accordingly in the UI and saw this reflected in the files:

- dbxquery.vmopts set to port 9999
- servermopts set to port 9998

After this the restarts allowed dbx to run. Thanks for the suggestion.