Splunk Dev

Splunk DB Connect java_home stanza error

cliffwakefield
Engager

Recently installed Splunk DB Connect and the path to the JRE has been entered into the WebUI.

However on startup of the Heavy Forwarder it is installed on you get the following error

Checking conf files for problems...
Invalid key in stanza [java] in /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf, line 2: javaHome  (value:  /usr/java/latest/jre).

Upon running btool you see:

$ splunk btool check --debug
...
Checking: /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf
                Invalid key in stanza [java] in /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf, line 2: javaHome  (value:  /usr/java/latest/jre).
        Did you mean 'java_home'?
        Did you mean 'jvm_options'?

The contents of /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf

[java]
javaHome = /usr/java/latest/jre

[loglevel]
connector = INFO
dbinput = INFO
dboutput = INFO

Now I now the issue is simple to correct because looking at the spec of https://docs.splunk.com/Documentation/DBX/3.1.0/DeployDBX/settingsconfspec shows it should be java_home not javaHome, but we never set javaHome the settings of DBConnect did.
alt text

We have no active support contract so can't even report this as an issue it appears.

Was wondering if everyone is running into this issue?

NOTE: No environment variable for JAVA_HOME exists.

jfarmiloe
Explorer

Hi - The issue is that the spec file is incorrect. The config checker looks for any options that don't have a match in the spec file.

If you change java_home to javaHome in etc/apps/splunk_app_db_connect/README/dbx_settings.conf.spec then "splunk cmd btool check" stops reporting the error.

The DBconnect app itself sets and expects to find an option called javaHome.

This issue has been corrected in the latest version of the app (3.1.3).

cheers
Justin.

Get Updates on the Splunk Community!

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...