Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- DBconnect to SCCM database
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DBconnect to SCCM database
Trying to connect to MSSQL for the SCCMdatabase. I'm trying to use a domain account, and Windows Authentication. If I try the MS_SQL Server Using MS Generic Driver with Windows Authentication, point it to the database I want to connect to, I get the following when trying to validate:
"This driver is not configured for integrated authentication." If I try MS-SQL Server Using MS Generic Driver, I get: "Login failed for user". If I try the jTDS drivers, I get connection timed out.
Can anyone help me figure this out? I'm trying to get the SCCM app working, just to see what it gives us, and I can't even get DBConnect to work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am able to connect to the SCCM database after creating a new user for Splunk giving permissions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to do the same exact thing you are! SCCM app doesn't work, and I need SCCM data, so I'm trying to get it with DBConnect.
Right now if I try to validate, port 1433, read-only flag checked, enable SSL flag unchecked, for MSSQL and Windows authentication and generic driver, it does validate and tells me connection saved successfully! And the enabled flag is set to true. However, I then get a connection error (at the top of the page, not next to the validate button like if you try to validate something that is invalid) and am not sure why. It populates the default database to be "master".
Any suggestions? The permissions are the default permissions for dbconnect.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes it takes the default database to be "master" But you can edit the jdbc url to specify your database name.
databaseName=XXX;
Also authenticate with MS-SQL Server Using MS Generic Driver and possible create a Splunk user to access those tables . You Can check with your DB guy to do that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what about the kerberos option? If your splunk box is on *nix, i think that's the one to try. And of course, be sure that you specified the domain in the identity you're using.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
KrbException: Cannot locate default realm
I am getting this above error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of DBConnect are you using? I was able to find the below response for the same issue
https://answers.splunk.com/answers/556315/splunk-db-connect-3-why-am-i-unable-to-login-using.html
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
