I am having the same woes over DB Connect's persistent storage.
I needed to alter the "bookmark" for where it begins reading SQL Audit logs. The Splunk Add-On for Sql Server could not determine the line log breaks. That was resolved, and the old indexed events deleted.
To have all the logs reloaded into splunk, I attempted editing state.xml with a date earlier than the first audit log entry. That did not work. Several other steps were taken with the persistentstorage\dbx\global folder, including backing up and deleting it.
Now, completely uninstalling and re-installing DB Connect and Java, following all the steps in the documentation and these recent posts, still will not recover the global folder.
Currently, "The Java Bridge server is not running ". Windows Task Manager shows Java(TM) Platform SE binary starting and stopping continuously. The jbridge.log says Unable to create directory C:\Program Files\Splunk\var\lib\splunk\persistentstorage\dbx\global .
The Java version that worked for me initially, and is currently installed:
server-jre-7u75-windows-x64.tar.gz
Using the above download link, it is very confusing determining the Java version to download. I gather 1.7 is the same as 7, and 7 will soon be unsupported by Oracle.
The DB Connect version is splunk-db-connect_117.tgz
This is all running on a single-server installation of SPLUNK on a Windows 2012 VM.
... View more
