splunk DB connect

[Prakash493]

Hi ,

i have a heavy forwarder where my db connect v 3 is installed and i am sending the data to my indexers , the data is forwarding to the indexers and i can see it but the amout of data was forwarded to my index was high but now i see the amount of data is forward to my index is less as compare to before. whats the reason ?

[koshyk]

It could be due to various reasons. You can try debugging it in few ways
1. Does the HF have UI enabled? if yes, try using your query to see if the results are being returned at all via the DBconnect UI
2. Check the DBconnect logs coming from HF. Does it give any clue? (or paste the logs here)
3. Check for errors in splunkd.log & dbconnect logs from HF to see if there is any errors , especially related to credentials or driver path
4. Create a dummy connection to the relevant SQL client and ensure if that's coming

for example if the client is Oracle, do a dummy query (and put create a connection) and see if that value is getting to the Indexers

select to_char(sysdate,'DD-MON-YYYY HH:MI:SS AM') from dual