I found this the hard way testing from a windows system going to a sql server, but the *_auth.dll (mssql-jdbc_auth-8.2.2.x64.dll in my case) file has to be placed in the proper location as well as the driver .jar file placed in the drivers folder. The section “Install the SQL Server database driver using a SQL server authentication”, Section 2. These directions were pretty easy to look over. https://docs.splunk.com/Documentation/DBX/3.3.1/DeployDBX/Installdatabasedrivers#Microsoft_SQL_Server In step 2 it also talks about the user that is used to connect being the service account splunk is running under. If that is localsystem then the machine account computername$ would be used to connect to the sql instance. It does not use the credentials specified in the identity assigned identity. I tested also with the jTDS Driver and that did exactly what one would expect and worked seamlessly.
... View more