I recently installed the Splunk DB Connect App in a distributed environment. Splunk version is 6.5.3. The database I want to ingest MS SQL data on port 1433. I wanted to know where (search head or indexer) to open port 1433 to get connectivity to the database and DB Connect App?
Thanks so much for the reply. How do I do that? I have 5 search heads (clustered) and the DBX was pushed out through the Deployer. Do I open outbound from the 5 Search heads (Clustered)? Also the how do I open the connectivity on the JDBC client? Any steps to follow?
You need to ensure that every SHC member has network connectivity to your database server. How you do that is completely dependent on your network environment, so I can't really answer that.
DBConnect uses whatever connection URL you specify.
Are you getting connection errors similar to what is described here?
This is the error message.
The TCP/IP connection o the host 10.X.X.X port 1433 has failed. Error: ' Connection timed out: no further information . verify the connection properties. Make sure that an instance of SQl is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by firewall."
This thread has the troubleshooting steps in it. Your network folks will be able to help you figure out why you cannot connect from sourceIP(SHC) to targetIP:1433
Most likely they need to put some firewall rules in place for you.