About jbspecht

jbspecht

Hi all, TA Studio wraps the official UCC Framework, giving you a modern, browser-based way to build Splunk add-ons. You can create data inputs, setup pages, sourcetypes, field extractions, CIM mappings, alert actions, and more — all through a point-and-click UI — then build a Splunkbase ready package at the click of a button. Other features include CSV and KV Store lookups, event types & tags, field transforms, workflow actions, saved searches, dashboard packaging, a live input/alert test runner, raw globalConfig.json and .conf editors for full control, AppInspect validation with run history, and optional AI assistance (bring your own API key). The goal was to have an alternative to Splunk's Add-on Builder that does more, runs faster, and clears the compatibility hurdles for development — cross-platform on Windows and Linux. Requirements: Splunk Enterprise 9.2.0+ (tested through 10.4.0), with splunk-add-on-ucc-framework and splunk-appinspect installed into Splunk's bundled Python. Full install steps are on the Splunkbase listing. I'd love your help testing it 🙏 This is a solo project, so real-world feedback is gold. If you give it a try and spot a bug or think of a useful enhancement, please email me at [email protected] with the details (steps to reproduce, your Splunk/OS version, and any logs help a lot). As a small thank-you: if you report a valid bug or a beneficial enhancement, I'll happily add your name or username to a Testers section on TA Studio's About page. Thanks for reading — and thanks in advance to anyone who kicks the tires.

jbspecht · ‎11-15-2024

Logs are now coming in as expected. Couple things that threw me off. - Besides adding the index to the dashboard portlet searches, i had to examine the XML to modify (add index) the base search at the top so the associated drop downs and results portlet at the bottom of the dashboard worked. - Changing the data inputs source type from 'Automatic' to 'From list' -> 'terraform_cloud' didn't take. It would revert back to 'Automatic' but in the end the source type is still correctly attached to the logs and fields are extracted. - Lack of documentation. Wasn't sure of the index, source, host, source type, polling interval, log level, etc. Could maybe be added to the setup page? Appreciate just having the app though.

jbspecht · ‎11-15-2024

It appears that you then have to change the data input (after completing the apps setup page) to set the index and source type. Also, the polling interval (default of 60 seconds) is found here. Along with this I went and changed the dashboard portlet searches to include the index. Hope this helps someone else. I've yet to get data in to confirm but will report back if I do.

jbspecht · ‎11-15-2024

For anyone else running into this below is what I've found so far of what the app does. Logs are sent to following... index=main host=https://app.terraform.io source=terraform_cloud sourcetype=terraform_cloud Two dashboards are added to the dashboards in Splunk. You can use these to determine where the logs are set to go which is to no index by default (main). Dashboards: [ HCP Terraform Analysis ] - Dark Theme [ HCP Terraform Analysis ] - Light Theme NEXT QUESTION: How to switch the index to get the logs securely stored and format properly recognized?

jbspecht · ‎11-15-2024

Installed the app yesterday on our cloud instance (Victoria) and I can't figure out what index it points data to or where that is configured? The setup UI never asks for the index. Also, I can't find any internal logs for the app to understand what may be going on. Feeling like this was created as an app whereas maybe it should have been an add-on in the add-on builder? Any help would be greatly appreciated. Josh

jbspecht · ‎07-02-2021

To add to this...when we switched from Oracle's Java to OpenJDK we lost (stopped working) all of our MS-SQL connections. Turns out the fix for this was to re-download the MS-SQL JDBC driver and put the 32 bit version of the sqljdbc_auth.dll in the C:\Windows\SysWOW64 directory and remove the x64 bit version in C:\Windows\System32 directory that was working fine before. After rebooting the server the MS-SQL connections started working again.

jbspecht · ‎07-02-2021

After much trial and error and time spent we've been able to use the following to get it to work. Hopefully this will help someone else. Things needed for Splunk DB Connect on Windows to work with a Hive 2 Kerberos connection: Kerberos MIT - https://web.mit.edu/kerberos/dist/ (kfw-4.0.1-amd64) Cloudera JDBC driver - https://www.cloudera.com/downloads/connectors/hive/jdbc/2-6-5.html (HiveJDBC41.jar) OpenJDK 8 - https://jdk.java.net/java-se-ri/8-MR3 Other things to mention: Oracle's Java 8 did not work for us. Krb5.conf configuration files placed in %JAVA_HOME%\jre\lib\security directory didn't seem to help DB Connect when verifying the connection. We tested successfully on Windows servers with Splunk v8.2/DB Connect v3.5.1 and Splunk v7.3/DB Connect 3.3.1. db_connection_types.conf file needs to exist or be created in the DB Connect local directory with a config that looks like this for the Cloudera driver... [cloudera_hive_2] displayName = Cloudera Hive 2 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = com.cloudera.hive.jdbc41.HS2Driver jdbcUrlFormat = jdbc:hive2://<host>:<port>/<database> port = 20500 ui_default_catalog = $database$ The more up-to-date versions of DB Connect are more verbose with any errors generated. If I were to start the process again I would install the newest version of DB Connect compatible with existing version of Splunk. Download OpenJDK v8, extract and copy it into a directory (C:\Program Files\Java\java-se-8u41-ri). Then create a JAVA_HOME system environment variable and place that directory inside as the value. Reboot the server. You may then need to manually update the "JRE Installation Path" field in DB Connects Configuration -> Settings -> General tab and Save. Then reboot Splunk web via Settings -> Server Controls. Once there are no more errors popping up, download the Cloudera driver and move it into the DB Connect "drivers" directory (\splunk_app_db_connect\drivers). Go to the Configuration -> Settings -> Drivers tab and click reload. The driver should now exist on the page and have a green check mark next to it along with the version. Install Kerberos MIT. Create a connection in DB Connect and setup a connection string in the "JDBC URL" field with something like... jdbc:hive2://dbserverhostname:10000/db_table_name;AuthMech=1;KrbRealm=domain_name_here;KrbHostFQDN=dbserverhostname;KrbServiceName=hive;KrbAuthType=2 Click "Save" and see if the connection is successful. If it is, there should be no errors that pop up.

jbspecht · ‎06-16-2021

We are trying to get a Cloudera Hive 2 connection in DB Connect to work but have so far been unsuccessful. We have tried the following versions... Splunk v7.3.0 with DB Connect v3.3.1, Java 8 Splunk v8.2.0 with DB Connect v3.5.1, Java 8 The newest version of Splunk and DB Connect gives a somewhat helpful error upon saving the connection... "[Cloudera][HiveJDBCDriver](500164) Error initialized or created transport for authentication: [Cloudera][HiveJDBCDriver](500169) Unable to connect to server: Failure to initialize security context." This however seems to be maybe a somewhat generic error as we have tried various means of authentication and we still receive this error. We are using the Cloudera Hive JDBC v2.6.5 driver. It has all the dependencies bundled into one jar as I understand it. We placed this into the DB Connect driver directory. We then created the "db_connection_types.conf" file in the local directory and added a stanza for the new driver. [cloudera_hive_2] displayName = Cloudera Hive 2 serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = com.cloudera.hive.jdbc41.HS2Driver jdbcUrlFormat = jdbc:hive2://<host>:<port>/<database> port = 20500 ui_default_catalog = $database$ DB Connect recognizes the driver however when we attempt to save the connection we receive a failure. If we try to move past saving the connection and try to retrieve data we receive a connection error. Any help would be very much appreciated as we have tried everything we can think of.

Posts	8
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎06-16-2021

Online Status	Offline
Date Last Visited	yesterday

[New App] TA Studio — a browser-based GUI for buil...

Terraform Cloud for Splunk

db connect and hive 2

[New App] TA Studio — a browser-based GUI for buil...

Re: Terraform Cloud for Splunk

Re: Terraform Cloud for Splunk

Re: Terraform Cloud for Splunk

Terraform Cloud for Splunk

Re: db connect and hive 2

Re: db connect and hive 2

db connect and hive 2

Join the Conversation