Splunk Enterprise

Splunk connect db not running queries after adding input

markawad
Engager

Hello,

I am on splunk 7.0.2, which is configured in a distributed environment. I installed splunk connect db on a SHC. Then from one of my search heads in the UI, I added my first input. (Note the connection to the db is fine, executing the sql query during setup, yields the expected result.)

However, after adding the input, I can see that connect db does not run the query at all, it ignores the frequency at which the query would run. This is seen in $splunk_home/var/log/splunk/splunk_app_db_connect_server.log

The data is not saved at all, I am not sure what am I missing or doing wrong. 

What is quite strange is that I cannot find any errors in the log that would help me at least debug why this is being caused, besides this error:  ch.qos.logback.core.Appender.error in splunk_app_db_connect_health_metrics.log

Note: The SHC is configured properly and is connected with the indexers. 

I have been facing a lot of issues with this.  Please help me find the solution or hint me towards how I can debug this.

Thanks,
Mark

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem began by configuring a DB Connect input on a SHC.  Inputs must be installed on a heavy forwarder.  See https://docs.splunk.com/Documentation/DBX/3.4.0/DeployDBX/Distributeddeployment

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem began by configuring a DB Connect input on a SHC.  Inputs must be installed on a heavy forwarder.  See https://docs.splunk.com/Documentation/DBX/3.4.0/DeployDBX/Distributeddeployment

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...