Splunk Search

DBX Query

New Member


I am having issues with dbx queries

I created a dashboard with dbx queries, I can run the queries, dashboard displays fine for me and other admins but standard users (non admins) get "unknown search command 'dbxquery'".

I am domain admin.
I am an admin on splunk

The users having the issue

  • Are not domain admin
  • They have permission on the sql database that splunk queries

I was looking at the article that would kind of explain why it works for me (being local admin on the splunk server)

Before using DB Connect, the logged-in user must have the ability to write to the $SPLUNK_HOME/var directory (%SPLUNK_HOME%\var on Windows hosts) and to $SPLUNK_HOME/etc/apps/splunk_app_db_connect ($SPLUNK_HOME/etc/apps/splunk_app_db_connect on Windows hosts) and its sub-directories

Am i reading this right? i have to grant read access on the splunk server directly if the dashboard user doesn't have permission to these folders? Surely i have that wrong? It can't be the case?


Labels (1)
0 Karma

Path Finder

the users needs to have access to the custom commands "dbxquery"

settings > advanced search > search commands


you have to tweak the permissions on the command. By default, only users with the role "admin & db_connect_*" have access to the command.

Either you expand the right, or you add the user that needs to do dbxquery the role "db_connect_user"

0 Karma

New Member

Thanks I'll have a look.
So the article i refer to is not relevant?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...