splunk db connect on heavy forwarder not forwarding to indexers

[leonaheidern2]

hi

I have this issue where the db connect installed on a heavy forwarder is not able to forward logs to the indexers in a particular sourcetype configured in the indexer

The heavy forwarder obtains the logs from the mssql database using http event collector

From splunkd log and metric logs i can see the non db connect logs being forwarded on the standard 9997 port

We are able to run the sql query in db connect and able to see results

Not quite sure where i should troubleshoot and hoping for some leads

The db connect version is 3.1.4 and the splunk enterprise version is 7.2.6

I do not see error 400 on the db connect server or command and audit logs tho

[leonaheidern2]

Not quite sure why it started to work again after a monthly restart of the entire infra

•  

[isoutamo]

Hi

DBX has own status display which you can use your SH. There is also dashboard where you could check those errors and drill in events to see what has happened.

r .Ismo