Splunk Dev

Splunk DB Connect java_home stanza error

cliffwakefield
Engager

Recently installed Splunk DB Connect and the path to the JRE has been entered into the WebUI.

However on startup of the Heavy Forwarder it is installed on you get the following error

Checking conf files for problems...
Invalid key in stanza [java] in /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf, line 2: javaHome  (value:  /usr/java/latest/jre).

Upon running btool you see:

$ splunk btool check --debug
...
Checking: /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf
                Invalid key in stanza [java] in /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf, line 2: javaHome  (value:  /usr/java/latest/jre).
        Did you mean 'java_home'?
        Did you mean 'jvm_options'?

The contents of /opt/splunk/etc/apps/splunk_app_db_connect/local/dbx_settings.conf

[java]
javaHome = /usr/java/latest/jre

[loglevel]
connector = INFO
dbinput = INFO
dboutput = INFO

Now I now the issue is simple to correct because looking at the spec of https://docs.splunk.com/Documentation/DBX/3.1.0/DeployDBX/settingsconfspec shows it should be java_home not javaHome, but we never set javaHome the settings of DBConnect did.
alt text

We have no active support contract so can't even report this as an issue it appears.

Was wondering if everyone is running into this issue?

NOTE: No environment variable for JAVA_HOME exists.

jfarmiloe
Explorer

Hi - The issue is that the spec file is incorrect. The config checker looks for any options that don't have a match in the spec file.

If you change java_home to javaHome in etc/apps/splunk_app_db_connect/README/dbx_settings.conf.spec then "splunk cmd btool check" stops reporting the error.

The DBconnect app itself sets and expects to find an option called javaHome.

This issue has been corrected in the latest version of the app (3.1.3).

cheers
Justin.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...