Deployment Architecture

DB Connect and Java versions

jcoates_splunk
Splunk Employee
Splunk Employee

Hi,

The march of progress is marching on, and we've got some Java updates to deal with. Oracle has ended support for Java 7 now (http://www.oracle.com/technetwork/java/eol-135779.html) and we have consequently updated our DB Connect toolset to take advantage of Java 8.

Java 8 offers significant improvements to security and performance, and we have elected to build DB Connect directly for this environment. Updating DB Connect from 1.1 to a newer version without updating the Java runtime is a breaking change. Here are the configurations expected to work:

  • Java 6 or 7 -> DB Connect 1.1
  • Java 8 -> DB Connect 1.2
  • Java 8 -> DB Connect 2.0

Please note that we test with and support Oracle Java only.

One more thing: the jTDS driver is not Java 8 compatible either, so you will need to switch to Microsoft's JDBC driver as noted here: http://docs.splunk.com/Documentation/DBX/2.0.0/DeployDBX/Supporteddatabases

1 Solution

jcoates_splunk
Splunk Employee
Splunk Employee

Java Runtime DB Connect Version

  • Java 6 or 7 -> DB Connect 1.1
  • Java 8 -> DB Connect 1.2
  • Java 8 -> DB Connect 2.0

JDBC Driver for Microsoft SQL

  • DB Connect 1.1 -> Microsoft SQL: jTDS driver or Microsoft JDBC driver
  • DB Connect 1.2 -> Microsoft SQL: Microsoft JDBC driver
  • DB Connect 2.0 -> Microsoft SQL: Microsoft JDBC driver

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Here's what worked for me, tmeader:

  1. Download the driver and copy sqljdbc4.jar into $SPLUNK_HOME/etc/apps/dbx/bin/lib/
  2. Describe the new driver type in database_types.conf
  3. Restart Splunk and change drivers in connections.

    $ cat splunk/etc/apps/dbx/local/database_types.conf
    [generic_mssql]
    displayName = MS-SQL Server Using MS Generic Driver
    jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver
    testQuery = SELECT 1
    connectionUrlFormat = jdbc:sqlserver://{0}:{1};databaseName={2};selectMethod=cursor

While we're at it, we can also remove the memory management option for Java, it just makes Java 8 complain. This isn't necessary to make it work though.

$ cat splunk/etc/apps/dbx/local/java.conf 
[java]
home = /usr/local/jcoates/jdk1.8.0_45/
options = -Dfile.encoding=UTF-8 -server -Duser.language=en -Duser.region=

[logging]
level = DEBUG
console = false
logger.com.splunk.dbx = DEBUG

I'll update the docs this weekend. Again, please accept my apologies for your time lost.

tmeader
Contributor

Thanks for the more detailed instructions for version 1.x. Can confirm that this is working fine now after re-upgrading to 1.2.

Appreciated.

0 Karma

tmeader
Contributor

So, I saw the update to this in the App Manager and updated earlier today (running 1.1.7 previously). I since wasted roughly 6 hours trying to get my MS SQL 2005 databases to connect anymore. Eventually I found this entry citing that Java 8 was required, so I upgraded to that, however that only fixes the overall issue with the bridge itself it seems. As you state, evidently the jTDS driver ALSO no longer works with this version? It doesn't seem that a simple upgrade through the App Manager should be allowed for a version that has so many breaking changes involved in it (clearly the 1.x->2.x version was not offered as an "upgrade" path. I understand that technically that's a separate app, and thus wouldn't truly be an upgrade anyhow, but still, the concept is the same when so many core requirements changed in a simple point release).

I've had to role back to 1.1.7 for the time being since, despite my best efforts, I've been unable to get the Microsoft SQL driver working properly with 1.2.0. If there were ANY documentation available from Splunk on how to do this for 1.2.x prior to releasing the version that breaks this functionality, that would've been nice. I've tried adding the following under database_types.conf in dbx/local (and then changing the DB connection to use mssql2), but it's still not working (yes, I have the sqljdbc4.jar installed from Microsoft):

[mssql2]
displayName = MS SQL Server 2005+
jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver
connectionUrlFormat = jdbc:sqlserver://{0}:{1}/{2}
defaultPort = 1433

Any insight on how to get a functional MSSQL setup running again after installing dbx 1.2.0 would be HIGHLY appreciated.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, these instructions should cover the installation of the Microsoft JDBC driver. I'm sorry that you've had this experience. http://docs.splunk.com/Documentation/DBX/2.0.0/DeployDBX/Installdatabasedrivers#Microsoft_SQL_Server

tmeader
Contributor

Thanks, but I've already looked through all that.

Can those be modified to include specific instructions for DBConnect 1.x please? The majority of those instructions, other than downloading the JAR file from Microsoft, are DB Connect 2.x specific and are NOT applicable to 1.x directly.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Java Runtime DB Connect Version

  • Java 6 or 7 -> DB Connect 1.1
  • Java 8 -> DB Connect 1.2
  • Java 8 -> DB Connect 2.0

JDBC Driver for Microsoft SQL

  • DB Connect 1.1 -> Microsoft SQL: jTDS driver or Microsoft JDBC driver
  • DB Connect 1.2 -> Microsoft SQL: Microsoft JDBC driver
  • DB Connect 2.0 -> Microsoft SQL: Microsoft JDBC driver
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...