Brand new CentOS 7 system with Splunk 7, DBConnect 3.1.1 and Java JDK 1.8.0_144. Splunk starts fine, DBconnect installs fine, but when I go to access the app, I just get the message Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code 127). I can't even access the controls to configure the DBconnect app, I just get the little circling spokes with the splunk controls at the top of the window. I've tried wiping Splunk and reinstalling to see if it was an issue with the Java install, but same results. Has anyone else run into this with new the version of Splunk? ... View more

Is there a way to get Forensic Investigator to use a proxy for the web calls, like Virustotal? When configuring other apps like the REST client for Splunk, when configuring a data input you can specify the proxy being used. I didn't see anything in the dashboard where that could be entered, but is there a .conf or app property sheet where this can be specified? It doesn't seem to be picking up the system proxy configured on the Splunk search head. ... View more

Made the jump on Friday to DBConnect 1.2. Started troubleshooting why our two MSSQL connections aren't working, after reading that Java 8 was required and getting that setup. I'm pretty sure that our config/install is working as our zOS/DB2 DB connection returns data like it did before the upgrade. Reading/Searching around, it appears that integrated authentication with DBX 1.2 is problematic, but I can't seem to get a clear understanding of what needs to transpire for this to work. I created a custom db type in database_types.conf with the following stanza: [generic_mssql] displayName = MS-SQL Server Using MS Generic Driver jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver testQuery = SELECT 1 connectionUrlFormat = jdbc:sqlserver://{0}:{1};databaseName={2};selectMethod=cursor Trying to update my configured database connections returns an error: Encountered the following error while trying to update: In handler 'databases': Error connecting to database: com.microsoft.sqlserver.jdbc.SQLServerException: Login failed for user 'domain/\user'. ClientConnectionId:cde99ae2-ee12-4375-b624-cafc0e5e5d9a hint: It's not a bad username | password I've read the documentation, and posts from other frustrated users, but is there a bonafide step by step specific to DBX 1.2 setup guide for MS-SQL? I copied the sqljdbc4.jar from the JDBC driver 4.0 from https://www.microsoft.com/en-us/download/confirmation.aspx?id=11774 to /opt/splunk/etc/apps/dbx/bin/lib, but I haven't found the winning combination yet. ... View more

I have a device matrix of all the hosts I want to receive data from configured in a lookup file. I'm trying to run a report that shows all the devices that I haven't received events from. This is proving to be much more difficult than I anticipated. I thought it would be as simple as running a search, deduping the hosts, outer join on the intersecting column, and isnull() on _time or _raw or some other field that wouldn't be present on hosts that don't have events. Challenge: My lookup file has a field called host. This is the IP address of the device. Find all devices (host) in the lookup file that don't have events in the index. Doable? (I realize this is asking splunk to tell me what it doesn't know, but I would think a lookup file solves that) ... View more