I am facing issues with indexing after the installation of Splunk dbconnect. Below are the details about the environment.
Splunk environment : Distributed with single search head and clustered indexers.
DB-Connect version : 3.1.1
Splunk version : 6.4.4
Server OS: Windows 2k12
Logs collected are from Microsoft SQL-Server database.
Current state:
DB-Connect is installed on search-head server and the queries are getting executed as expected in the SQL-Explorer.
Issue :
Neither the “dbx” logs nor the “inputs” are getting indexed. How do I forward these to the indexers so that I can search using search and reporting app.
Also I have not installed forwarder on search-head. Do I need to do it or does dbconnect app internally forward data to the indexers.
Could you please help me in fixing this issue.
... View more