Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pmdba
pmdba
Builder
Member since:
05-15-2013
06-05-2020
Community Statistics
| Posts | 138 |
| Solutions | 22 |
| Karma Given | 5 |
| Karma Received | 53 |
| Member Since | 05-15-2013 |
Activity Feed
- Got Karma for Re: Excute sql statement on splunk db connect. 08-19-2020 05:09 AM
- Got Karma for Re: Does Splunk DB Connect 2 cause full table scans for every query against Oracle?. 06-05-2020 12:48 AM
- Got Karma for Re: Does Splunk DB Connect 2 cause full table scans for every query against Oracle?. 06-05-2020 12:48 AM
- Karma Re: How can I index login/logout logs from an Oracle database in Splunk? for fdi01. 06-05-2020 12:47 AM
- Karma Re: how to save oracle db query results into a CSV format and use this CSV file to index into SPLUNK to generate dashboards for vganjare. 06-05-2020 12:47 AM
- Got Karma for How can I get time span buckets to be relative to now?. 06-05-2020 12:47 AM
- Got Karma for Re: How to index Oracle dynamic performance views (v_$transaction, v_$session etc) in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: How to index Oracle dynamic performance views (v_$transaction, v_$session etc) in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect V1 Database connection release. 06-05-2020 12:47 AM
- Got Karma for Re: Can Splunk monitor the response times of Oracle forms and how to do this?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to query a temp table using Splunk DB Connect?. 06-05-2020 12:47 AM
- Got Karma for Re: DBConnect changing the date column value automatically to wrong date. 06-05-2020 12:47 AM
- Got Karma for Re: DBConnect changing the date column value automatically to wrong date. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 2: Is it possible to establish an Oracle DB Connection with a tnsnames.ora entry?. 06-05-2020 12:47 AM
- Got Karma for Re: How to index Oracle dynamic performance views (v_$transaction, v_$session etc) in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: How can I connect thousands of individual databases to Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: Configure input before execute oracle procedure and select. 06-05-2020 12:47 AM
- Got Karma for Re: DB Connect: After patching our Red Hat Enterprise Linux 6 OS and updating java.conf file, why are we receiving HTTP 401 errors?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect: How to use $rising_column$ as an aliased column?. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect: How to use $rising_column$ as an aliased column?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
Disabling the connection probably just prevents Splunk from opening new connections. I suspect that it won't disconnect existing ones. Check the java.conf file for connection pooling settings; consider setting pool.maxIdle=0 to let the connection pool cleanup all idle sessions. You should also have your database configured to time-out idle sessions and clean it up that way.
... View more
05-04-2015
03:54 PM
From the error message it appears that the database name is not being passed to the search. The search should contain something like
database="dbname"
not a null value for the database. I'm not sure what would cause this to happen, but you might want to check your database.conf file and make sure the connection is defined correctly.
... View more
05-04-2015
03:50 PM
The "index" parameter in your inputs.conf file should name the Splunk index in which your data will be stored; unless your index is named "true", you probably need something else here. Make sure you have created an index on the indexer to hold the data, and that it is named here. See this documentation for an example of what should be in inputs.conf. You should also have an "outputs.conf" file defined that tells the forwarder where to send its data. See the documentation here for more information on outputs.conf.
... View more
04-29-2015
02:24 PM
1 Karma
I believe that the UI only controls what is collected on the local indexing server or search head where it is installed. It does not configure distributed apps directly. If you configure the add-on as a distributed app you can change the inputs.conf file on your distribution server (one place) and push it out to all your remote forwarders that way.
... View more
04-29-2015
02:19 PM
It's hard to say for sure, but my best guess based on what you've shared is that something is now being routed to the proxy that shouldn't be - such as a call to localhost or some such that the proxy doesn't know how to handle, so the connection times out.
... View more
04-24-2015
10:59 AM
2 Karma
If you are connecting to a SCAN address, then you don't need the complex TNSNAMES entry. The whole point of SCAN is to move the load balancing and failover complexity to the server and out of the client configuration. SCAN handles the load balancing and failover parameters can be defined a a part of each service name. Then you can simply use the JDBC-Thin driver with the SCAN hostname and the Oracle service name to connect, as described in this post.
Potentially you could also alter the connect string prototype in the db_connection_types.conf file to use a JDBC-Thick (OCI) connection, something like this:
jdbcUrlFormat = jdbc:oracle:oci:@TNSALIAS
This would allow you to use TNSNAMES, say to define a connection string with SOURCE_ROUTE, enable strong network encryption, or to use LDAP resolution instead of tnsnames.ora. I have made similar changes with other applications designed to use the Thin connection with no problem, but I have not tested such a configuration with Splunk and I'm not sure if it would work. Perhaps someone from Splunk could comment on that configuration, and whether or not is has ever been tested...
... View more
04-16-2015
05:37 AM
4 Karma
The connect string format is defined in the DBX v2 "db_connection_types.conf" file:
[oracle]
displayName = Oracle
serviceClass = com.splunk.dbx2.OracleJDBC
jdbcUrlFormat = jdbc:oracle:thin:@//<host>:<port>/<database>
jdbcDriverClass = oracle.jdbc.OracleDriver
database = XE
testQuery = SELECT 1 FROM DUAL
port = 1521
Make sure you copy the file from the default folder to the local folder before making changes. See the documentation for more details.
... View more
04-14-2015
03:32 PM
Have you looked at the AS/400 app for Splunk? There are a number of related questions on this site, as well.
... View more
04-03-2015
09:05 PM
You can also check out this paper for more information on a variety of ways to get Oracle data into Splunk. If you want to report database changes in real-time, then db-tail may not be the best option. db-tail can capture incremental changes, but it still runs like a scheduled job - at most once per minute - and runs a query on your data that will put some minimal additional load on your system. If that is close enough to real-time for you, then it is probably the easiest option.
If you need closer to real-time, then your best bet would be a PL/SQL trigger or some such that would transmit the data directly to Splunk on a TCP input. There is some risk of data being lost that way (if packets were lost on the network or if the trigger failed for some reason) but it would be as close to real-time as you could get. There is an example of how to set this up in the paper.
... View more
04-01-2015
02:33 PM
It is important to note that the monitoring described in the white paper is NOT a core feature of Oracle database. It requires separate licensing of the Oracle Tuning Pack for Enterprise Manager. If you use these views and you don't have a license and Oracle audits you (yes, they do that) then they can send you a BIG bill. Also worth noting is that any information in V$ views is highly volatile. A DB Connect input would have to run at the most frequent rate - once per minute - to pick up everything you wanted to see, and even then might not get everything.
I would recommend looking into Oracle STATSPACK. It's a free option that may provide the sort of information you're looking for.
... View more
03-17-2015
09:08 AM
For a starting tutorial on monitoring Oracle with Splunk, try Log File Analysis for Oracle 11g. It describes most of the things you are asking about. If your Splunk installation will not be located on the same server as your Oracle database and SQL commands through DB Connect will not work to get the data you need, then you will also need to look at using the Universal Forwarder.
... View more
02-19-2015
09:25 AM
A basic tutorial on configuring Splunk monitoring for Oracle can be found here: https://apps.splunk.com/app/1538.
... View more
The answer finally turned out to be updating our Java configuration. We had originally been using the Java runtime included with the operating system. We had to install the latest Java 7 SE runtime from Oracle and redirect DBX to use that by updating the $SPLUNK/etc/apps/dbx/local/java.conf file.
... View more
01-30-2015
02:52 AM
Check out the following documentation and blog posts, which talk about how to use database repository views for EM. These views should be accessible using Splunk DB Connect.
Enterprise Manager Cloud Control Management Repository Views Reference
OEM 12c repository views
Oracle Enterprise Manager 12c Metrics Monitoring and Management Repository Views: Tips and Tricks
... View more
01-30-2015
02:04 AM
The actual search should probably look something like this for tickets closed in the last week (my syntax is for Oracle):
| dbquery "dbname" "select to_char(DateClosed,'YYYY-MM-DD HH24:MI:SS') DateClosed, TicketID from TableA where DateClosed>trunc(sysdate-7) group by DateClosed" | timechart span=1d sum(TicketID) by DateClosed
This will allow you to timechart the number of tickets closed by any span size you want.
... View more
01-24-2015
02:58 PM
I begin to see the difficulty. I haven't tried this - perhaps you have already - but would something like this work?
/apps/oracle/install/admin/instances/${hostname}*
You just need a common environment variable that returns the hostname...
... View more
01-23-2015
01:11 PM
I use wildcards for similar situations. For instance, I pick up alert log files for Oracle with something like this:
monitor:///apps/oracle/diag/rdbms/*/*/trace/alert*.log
This picks up all alert logs on the system for every database, including any that I might add in the future, with one input. In your case I would think something like this would work:
/apps/oracle/install/admin/instances/ovdpmmk*
... View more
01-23-2015
12:43 PM
1 Karma
Currently DB Connect documentation states that it only works with Java 6 (already past end-of-life) and Java 7 (end-of-life in April 2015). Our organization will not allow Java 7 apps on our network once security patches are no longer available for it. Does anyone at Splunk know when support for Java 8 will be available?
... View more
01-22-2015
03:22 PM
I haven't used SQLServer in a long time, but as I recall a lot of what it records goes into the Windows system logs. The Splunk App for Windows Infrastructure or the Universal Forwarder should be able to pick up those records. For anything getting written to an actual log file it should just be a matter of creating a custom file input and directing the data to an index, as described here.
... View more
01-22-2015
01:39 PM
You can use wildcards in the path. E.g. /apps/oracle/install/admin/instances/*/myfile
For a look at a variety of input types, including this one, check out Log File Analysis for Oracle 11g on the apps.splunk.com web site.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
