hi
I have this issue where the db connect installed on a heavy forwarder is not able to forward logs to the indexers in a particular sourcetype configured in the indexer
The heavy forwarder obtains the logs from the mssql database using http event collector
From splunkd log and metric logs i can see the non db connect logs being forwarded on the standard 9997 port
We are able to run the sql query in db connect and able to see results
Not quite sure where i should troubleshoot and hoping for some leads
The db connect version is 3.1.4 and the splunk enterprise version is 7.2.6
I do not see error 400 on the db connect server or command and audit logs tho
Not quite sure why it started to work again after a monthly restart of the entire infra
Hi
DBX has own status display which you can use your SH. There is also dashboard where you could check those errors and drill in events to see what has happened.
r .Ismo