Splunk DB Connect Addon

[arusishere]

Dear Splunk Community,

I need some advice on how to get DB Connect configured. I'm hitting a brick wall trying to get it up and running. I believe I have done the driver installs, database connection settings, JDK install, and set environment variables correctly.

I have gotten to the point where we can see login errors in the SQL server logs. With this, I know the servers are attempting to communicate.

Here is the system setup:

• Splunk OS: Windows
• Splunk Version: 9.0.9
• JDBC Drivers installed: 12.4
• Connection settings: Tried both MS-SQL Generic and Windows Authentication
• Database OS: Windows Server 2016 (SQL 2019)

Errors received from different attempts:

• Login failed for user xxx (On splunk)
• This driver is not configured to perform integrated authentication. (On splunk)
• Login failed for use <username> Reason: An attempt to login using SQL authentication failed. Server is configured for Windows authentication only. (On Windows SQL)

My resources:

• https://lantern.splunk.com/Splunk_Platform/Product_Tips/Extending_the_Platform/Configuring_Splunk_DB...
• The splunk documentation labyrinth.

I would also like to add that I've gone through the labyrinth of documentation Splunk provides (it's overwhelming). Also, oddly enough, a friend with a very similar environment is having the same issue.

Any advice would be much appreciated. And no, I will not install the JTDS drivers that some people recommended. It's open source and 10+ years old. Splunk's provided procedures and documentation that should work.

Thanks for your help. First time posting!

Kind Regards,

[isoutamo]

Hi

Have you look this and especially those logs which are pointed here https://docs.splunk.com/Documentation/DBX/3.18.2/DeployDBX/Troubleshooting

BTW. your splunk version is already out of support and you should update it. You didn't mention which DBX version you have? Based on JDBC version I suppose that it isn't then newest one but some pre 3.10 version? 

If you are setting this from scratch I strongly suggest you to take newest version which you can run your OS + Splunk + Java combination! There have been radical change 3.10+ how JDBC drivers have packed with DBX.

Even your environment is configured to use Windows domain authentication, I'm expecting that you can still create a local DB user on your MS SQL server and use it. E.g. with linux HF this is the way how it must do in most cases.

r. Ismo

[arusishere]

Hi Isoutamo,

Thank you for the quick response. I'll take a look at the link provided for troubleshooting.

In the meantime to answer your questions...

We are using DB connect 3.18.2 which is the newest version. We do have the updated JRE version that is compatible installed (JDK 17). 

I've confirmed Java is indeed working by running the java version command on the server. It indeed comes back with the installed version so the environmental variable is confirmed working and correct. Also, the DB connect page would not work correctly if Java is not installed. I am able to navigate to the page so we can probably rule Java being an issue out.

Will post a solution/update once I go through that troubleshooting page.

Kind Regards,

[livehybrid]

Hi @arusishere 

The issue with Splunk DB Connect appears to be related to authentication mismatches between Splunk and your SQL Server. Please can you confirm - when you created an identity for authentication, did you setup Windows authentication (Domain/User/Password) rather than just SQL authentication (User/Password)? As it seems like your DB server is setup for just Windows Authentication.

Based on the docs you also need Splunk DBX Add-on for Microsoft SQL Server JDBC which I presume has been installed? (See install docs) .

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[arusishere]

Hello Livehybrid,

Thank you for the quick response. We did indeed try Windows Authentication. We have confirmed the permission and password is correct as we attempted to login with the account. Access rights are also correct as we were able to navigate the necessary areas of the database.

We also tried the SQL authentication. We even made a direct SQL account when we attempted SQL authentication (non windows auth). No luck there either.

I have failed to mention in my original post the DB connect version. We have 3.18.2 installed. We also have all the necessary JDBC drivers installed.

If there are any other data points I can provide to assist with getting some help on this please let me know.

Kind Regards,