Why can't I connect to SQL database using Splunk DB Connect?

[nick405060]

Using DBConnect 1.2, jre8, my RPC service is up, my identity is using Windows Authentication, I've tried MS-Server using the Generic driver as well as MS-Server using Windows auth, and my etc/apps/splunk_app_db_connect\bin\lib folder looks like:

jtds-1.3.1.jar
rpcserver-all.jar
sqljdbc42.jar

I've reloaded the drivers in DBConnect and restarted RPC service. In DBConnect settings -> drivers, I have green checkmarks next to only:

MS-SQL Server Using MS Generic Driver (unsupported)     6.0
MS-SQL Server Using MS Generic Driver With Kerberos Authentication (unsupported)        6.0
MS-SQL Server Using MS Generic Driver With Windows Authentication (unsupported)     6.0
MS-SQL Server Using jTDS Driver     1.3
MS-SQL Server Using jTDS Driver With Windows Authentication     1.3

Any help would be greatly appreciated. Not sure why this is INSANELY complicated. I have two servers, SCCM01 and SCCMSQL01. If I try to connect using these settings and MS SQL server with Windows Auth to SCCM01, it times out. If I do the same to SCCMSQL01, then it tells me

com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: The TCP/IP connection to the host SCCM01, port 1433 has failed. Error: "Connection refused: no further information. Verify the connection properties. Make sure that an instance of SQL Server is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by a firewall.".

Note that in the error it mentions SCCM01 even though I am trying to connect to SCCMSQL01??? And then after waiting 30 seconds the error message CHANGES?? to

com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: This driver is not configured for integrated authentication. ClientConnectionId:2519ae7b-85e1-48b2-8bff-7a63fd521f45

Beyond frustrated with the fact that literally any data input you try to set up in Splunk is almost invariably going to NOT work, while Splunk keeps boasting how easy it is to get data in

[mstjohn_splunk]

hi @nick405060

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[mstjohn_splunk]

HI @nick405060

I'm glad to see that you are using the Karma bounty feature! However, it won't work if you don't engage with the user trying to answer your question. Please approve the question below so the user can receive their Karma points. Or, if the solution didn't help you, please explain why so that they — or someone else — can.

Thanks for posting!

[MuS]

Hi nick405060,

the message says:

Connection refused: no further information. 

and further more:

Verify the connection properties. Make sure that an instance of SQL Server is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by a firewall.

So, the first thing to test here is if you can connect from the Splunk instance to your DB server on the configured port?

and btw: that is not related to the error, but maybe consider an upgrade of the DBconnect app later. 1.2 is end of life

Hope this helps ...

cheers, MuS

[nick405060]

I switched to v4.2 of the JDBC driver from 6.0, got rid of the unsupported parenthesis.... but still same errors

[nrduren1115]

Is Splunk running on Linux or Windows?

[nick405060]

Running on Windows