We are attempting to integrate a QuickFill (QF) database with Splunk for reporting purposes; by default QF prefers ODBC for database connections. Our QF database lives on one server while the Splunk indexer lives on another server.
Everything I've found about ODBC so far seems to indicate that you can only connect Splunk to an ODBC database that lives on the same server as the Splunk indexer itself. Is this true, or is there something I'm missing? Do I need a forwarder set up on the QF server to plug into its database and then push the data to the indexer (rather than having the indexer pull the data)?
Yes, but I get an error:
[Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
Clarification: This is the information I'm filling out:
Database type: ODBC
Host: [QF server's IP address]
Username/password as appropriate
The "Fetch database names" button doesn't do anything, so I put "QuickFill DEMO Database" (the name of the database on the QF server) in and try to save. That's when I get that error.
I installed QuickFill Workstation on the Splunk server in order to get the QF ODBC driver. Once I had that, I was able to set up the System DSN.
I was also able to save the ODBC database connection in DB Connect, but only by disabling the "Validate Database Connection" option; it was timing out, "Encountered the following error while trying to update: Splunkd daemon is not responding: ('The read operation timed out',)"
When I was filling out the database connection, it was able to connect well enough for "Fetch database names" to work, so I'm not sure why it's timing out on saving.
This ODBC connection timing out has also broken the DB Connect app in general, causing it to time out for everything. I had to disable the ODBC external database we'd set up.
I have had some trouble with DB Connect in the past, so I just use python scripts to query remote database servers, fetch the results and echo them to the terminal, so the a scripted input can place it in Splunk.
I'm currently attempting to connect to a local QF database via ODBC.
I have upgraded to Splunk 6 which seems to have resolved the timeout issue. However, I continue to receive this error when attempting to search/access the database through DB Connect:
Error getting database connection: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
Example command that generates this error:
| dbinfo tables database="QFDEMO" schema="*"