Install DB Connect1 on indexer

[karabsze]

Hi all,

We are going to use DB Connect 1 to get data from Database. And we would like to setup the dbx on the indexer instead on search head.
Is there any other possible impact if we have no usage on reporting or database lookups?

Many THanks!

Best Regards,
Karab

[Richfez · Accepted solution]

You only need DBX installed somewhere it can put data into the indexer. Once it's in and searchable in Splunk, then you have no further need of the DBX app for that data - though of course you still need it to get new data in.

IMO, the impact of the DBX stuff if you aren't using the DBX stuff is negligible.

This is all assuming you are not using dbquery to generate all your stuff but are instead using regular DBX-based inputs to "read" the tables/data you want and index it. If you are trying to write your searches using dbquery, then I'd think you would need the dbx stuff installed on the search heads because the search itself will attempt to talk to the DB in question. I'd recommend not generally doing that as it changes the loads on the systems involved.

I hope this answers this question, as I'm not entirely sure I understood it correctly but thought I'd give it a shot anyway.

[karabsze]

Thanks rich.

Yes, I am just using the dbx as a modular input. That is good to hear that the impact is negligible in the view of DBX stuff. Do you know if DBX setup might decrease the stability on the indexers?

Moreover, I agreed that using dbquery directly would increase the difficulty to control the loading to db. :

[Richfez]

Glad I could answer the first questions.

To be complete and answer the remaining ones:

I would very much doubt it would affect stability or performance or anything else on the indexer.

I don't think the DBX app does anything "automatically" until and unless you've configured some dbmon inputs. So, without any inputs, dbx should just be more or less a set of files (relatively small) on disk in your $splunkhome$/etc/apps directory. There are some apps that "do things" behind the scenes, but I don't think this one is one of them. Nothing significant, anyway.

All in all, I'd not worry about the dbx app and its components. Obviously, I can't guarantee anything, but honestly, it's pretty well behaved and when not configured to do anything it ... won't do anything. 🙂 Even when configured to do things, it still is pretty well behaved, not affecting much else except with whatever general load it causes.

[jcoates_splunk]

If your indexers don't have Java, it definitely won't do anything