Getting Data In

Splunk DB connect - Cannot get schemas


Hello splunk community,

There might be some configuration issues in our environment, but I could not find anything standing out even after I turned on all logging to "DEBUG" mode. Following are the symptoms of the issue:

1. On the "New Input" left manual:

I am able to pick a connection; a Catalog ("TE"), but then "Schema" section turns red and shows "Cannot get schemas". < the user has full admin right on the server>

2. On the "SQLEditor":

If I type in SELECT * from TE.dbo.Node, and execute the query, the correct results will be returned.

So it seems that on the same splunk page, the results are contradicting each other, can anyone help to point me to the right direction on how to resolve this.

The DB connect version is 3.2.0; and I am using connection type MS-SQL Server Generic Driver (Ver. 3.0), SQL server itself is SQL2016.

Also, please also note that the same connection and user setup is able to get the other schemas on the same SQL instance without any issues; only failed in one particular database, and even after I tried to restore the troublesome db to a different name.

Thank you very much in advance.

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

As per harsmarvania57:

In DB, there are schemas available and each schema have different table. So in DB you need to provide schema access & table access to user from which splunk is trying to fetch data.

Original post: 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!