All Apps and Add-ons

splunk db connect on heavy forwarder not forwarding to indexers

leonaheidern2
Loves-to-Learn Lots

hi

I have this issue where the db connect installed on a heavy forwarder is not able to forward logs to the indexers in a particular sourcetype configured in the indexer

The heavy forwarder obtains the logs from the mssql database using http event collector

From splunkd log and metric logs i can see the non db connect logs being forwarded on the standard 9997 port

We are able to run the sql query in db connect and able to see results

Not quite sure where i should troubleshoot and hoping for some leads

The db connect version is 3.1.4 and the splunk enterprise version is 7.2.6

I do not see error 400 on the db connect server or command and audit logs tho

Labels (1)
0 Karma

leonaheidern2
Loves-to-Learn Lots

Not quite sure why it started to work again after a monthly restart of the entire infra

  •  
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

DBX has own status display which you can use your SH. There is also dashboard where you could check those errors and drill in events to see what has happened.

r .Ismo

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!