About xlin

xlin · ‎07-30-2020

Hello splunk community, There might be some configuration issues in our environment, but I could not find anything standing out even after I turned on all logging to "DEBUG" mode. Following are the symptoms of the issue: 1. On the "New Input" left manual: I am able to pick a connection; a Catalog ("TE"), but then "Schema" section turns red and shows "Cannot get schemas". < the user has full admin right on the server> 2. On the "SQLEditor": If I type in SELECT * from TE.dbo.Node, and execute the query, the correct results will be returned. So it seems that on the same splunk page, the results are contradicting each other, can anyone help to point me to the right direction on how to resolve this. The DB connect version is 3.2.0; and I am using connection type MS-SQL Server Generic Driver (Ver. 3.0), SQL server itself is SQL2016. Also, please also note that the same connection and user setup is able to get the other schemas on the same SQL instance without any issues; only failed in one particular database, and even after I tried to restore the troublesome db to a different name. Thank you very much in advance.

xlin · ‎07-27-2020

Thank you so much for your quick chli_splunk. Our team have decided to reinstall the system and components, so hopefully the new installation will be ok. For your information, we had Splunk DB Connect version 3.3.1; our DB is sqlserver 2016; default collation is SQL_Latin1_General-CP1_CI_AS. Also, I see an error message in splunkd might have something to do with the issue we had: 07-27-2020 13:18:15.218 +0000 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\dbxquery.exe"" action=dbxquery_server_start_failed error=java.net.BindException: Address already in use: JVM_Bind stack=java.net.DualStackPlainSocketImpl.bind0(Native Method)\\java.net.DualStackPlainSocketImpl.socketBind(Unknown Source)\\java.net.AbstractPlainSocketImpl.bind(Unknown Source)\\java.net.PlainSocketImpl.bind(Unknown Source)\\java.net.ServerSocket.bind(Unknown Source)\\java.net.ServerSocket.<init>(Unknown Source)\\java.net.ServerSocket.<init>(Unknown Source)\\com.splunk.dbx.command.DbxQueryServer.run(DbxQueryServer.java:100)\\com.splunk.dbx.command.DbxQueryServerStart.startDbxQueryServer(DbxQueryServerStart.java:88)\\com.splunk.dbx.command.DbxQueryServerStart.streamEvents(DbxQueryServerStart.java:47)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.command.DbxQueryServerStart.main(DbxQueryServerStart.java:98)\\

xlin · ‎07-23-2020

Hello Splunk community, We had the splunk heavy forwarder set up on one machine, and SQL server database on the other machine. On "Splunk DB Connect" app, when we try the "New Input" on "Data Lab" tab: 1. We are able to select the Connection 2. We are able to select Catalog (Dbname) 3. We are able to select Schema (dbo) 4. We are able to view list of tables and when select "tablename", we see the sql text on "SQL Editor": SELECT * from "Dbname"."dbo"."tablename" But the query could not return any data back to the "Preview Data" window. Status of data loading stopped at 20%. When Click the "Execute SQL" button on the page, nothing changes. The status bar stopped same at 20%. Also, we have no issue to run the same query and get the data back on SSMS on the same machine. I am very new to splunk, any help and suggestions are much appreciated!

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-23-2020

Online Status	Offline
Date Last Visited	‎08-04-2020 04:42 AM

Splunk DB connect - Cannot get schemas

Heavy Forwarder can not preview SQL server data

Splunk DB connect - Cannot get schemas

Re: Heavy Forwarder can not preview SQL server dat...

Heavy Forwarder can not preview SQL server data