All Apps and Add-ons

_internal index not updating, once the Splunk DB Connect 3.1.4 is enabled in Splunk 7.1.1? is there any limitation?

vengat4043
Path Finder

Hi,

In our Production environment we have one Search head and two indexers, all the instance are running in Splunk Version 7.1.1. Recently we faced a issue in one of our indexer like DB_Inputs automatically removed from the Splunk DB Connect App 2.4.0 Version. As our Vendor suggested we upgraded the DB Connect APP to 3.1.4. But now we are facing a different issue, whenever the Splunk DB Connect app 3.1.4 is enabled the Internal logs are not updating? is there any limitation? kindly suggest?

0 Karma

codebuilder
Influencer

My guess is that you are trying to search the _internal index from within the DB Connect app context, which does not (generally) have permissions to do so.

Change your search context to the actual "search" app and it should work for you just fine. Enabling DB Connect does not cause the search head to stop forwarding internal logs.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

harsmarvania57
Ultra Champion

Hi,

On which instance DB connect in installed, Search Head OR Indexer? There are no such limitation that when you enable DB connect, splunk will stop generating/sending internal logs.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...