Getting Data In

DB Connect with SHP - multiple Java bridge processes?

sowings
Splunk Employee
Splunk Employee

If I'm attempting to provide a bit of redundancy / high availability for my database inputs by installing DB connect in a search head pool (SHP), does that mean I will be running multiple Java bridge processes? If one of my SH is unable to execute a scheduled dbmon-tail search, will one of the others in the pool take up the task?

0 Karma
1 Solution

ziegfried
Influencer

Yes, multiple java bridge processes will run. If you're running that on the same machine, you have to configure different ports for the java bridge on both instances in $SPLUNK_HOME/etc/system/local/java.conf

[bridge]
port = 4712

It's not recommended/supported to run database inputs on DB Connect on a SHP instance. You should use a separate heavy forwarder for this in that case.

View solution in original post

0 Karma

ziegfried
Influencer

Yes, multiple java bridge processes will run. If you're running that on the same machine, you have to configure different ports for the java bridge on both instances in $SPLUNK_HOME/etc/system/local/java.conf

[bridge]
port = 4712

It's not recommended/supported to run database inputs on DB Connect on a SHP instance. You should use a separate heavy forwarder for this in that case.

0 Karma

ziegfried
Influencer

Correct. There are no integrated means to gain redundancy for database inputs. If this is required then I'd recommend using external means, such as a VMware HA for the heavy forwarder.

0 Karma

sowings
Splunk Employee
Splunk Employee

A separate heavy forwarder doesn't get me my redundancy, though. The point of trying to run DB connect on the members of a SHP is to have multiple hosts available to do the "dbmon-tail" or "dbquery".

What is the suggested best practice for this, if not to use SHP?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco  Security Analytics and Logging (SAL) is now generally available as part of the ...