Activity Feed
- Got Karma for Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server?. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server?. 06-05-2020 12:49 AM
- Got Karma for Re: Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs?. 06-05-2020 12:48 AM
- Got Karma for Re: Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs?. 06-05-2020 12:48 AM
- Karma Re: Is there a way for the HipChat Room Notification Alert app to use an http_proxy setting to make calls to the internet? for jeremiahMN. 06-05-2020 12:47 AM
- Posted Re: Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 02:41 PM
- Posted Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Tagged Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Tagged Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Tagged Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Tagged Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Tagged Splunk DB Connect: Why is there a TLS ERROR between bridge and MS SQL Server? on All Apps and Add-ons. 02-27-2018 12:54 PM
- Posted Re: Is there a way for the HipChat Room Notification Alert app to use an http_proxy setting to make calls to the internet? on All Apps and Add-ons. 07-14-2016 02:05 PM
- Posted Re: Is there a way for the HipChat Room Notification Alert app to use an http_proxy setting to make calls to the internet? on All Apps and Add-ons. 07-14-2016 12:28 PM
- Posted Re: Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-08-2016 11:05 AM
- Posted Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-07-2016 10:21 AM
- Tagged Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-07-2016 10:21 AM
- Tagged Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-07-2016 10:21 AM
- Tagged Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-07-2016 10:21 AM
- Tagged Does the Splunk App for Windows Infrastructure support multikv mode for perfmon inputs? on All Apps and Add-ons. 04-07-2016 10:21 AM
Topics I've Started
02-27-2018
02:41 PM
1 Karma
Right, so I upgraded to Java 1.7.95 and specified ‑Djdk.tls.client.protocols="TLSv1.1,TLSv1.2" located in the SPLUNK_HOME/apps/dbx/local/java.conf.
My full java.conf is below.
[java]
home = /usr/java/latest/
options = -Xmx1G -Dfile.encoding=UTF-8 -server -Duser.language=en -Duser.region= -Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols="TLSv1.1,TLSv1.2"
Logging settings
[logging]
level = DEBUG
file = dbx.log
console = false
logger.com.splunk.dbx = DEBUG
... View more
02-27-2018
12:54 PM
1 Karma
I'm unable to get Splunk DB Connect 1.2.2 (Yes, I know its old) to connect to an instance of MS SQL server where TLS 1.0 has been disabled. When the connection attempt is made I get the error below. When I enable -Djavax.net.debug=all I can clearly see Splunk trying to pass a TLS1.0 handshake over to the database. In fact, I have two database connections configured in the Splunk DB Connect app. One has a database where TLS1.0 is not disabled and the other is a database where we've disabled TLS1.0. As you can imagine the database where we haven't disabled TLS1.0 is working just fine, but the other connection is not. We are running Java 1.7.60. I've tried switching over to Java 1.8.74
2018-02-27 13:27:41.556 dbx9703:ERROR:DatabaseList - Error fetching database catalogs: java.sql.SQLException: Network error IOException: null
java.sql.SQLException: Network error IOException: null
at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:417)
at net.sourceforge.jtds.jdbc.ConnectionJDBC3.<init>(ConnectionJDBC3.java:50)
at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:185)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at com.splunk.dbx.sql.type.impl.AbstractDatabaseType.connect(AbstractDatabaseType.java:139)
at com.splunk.dbx.sql.type.impl.MicrosoftSqlServer.connect(MicrosoftSqlServer.java:85)
at com.splunk.dbx.sql.type.impl.AbstractJtdsDatabaseType.listCatalogs(AbstractJtdsDatabaseType.java:48)
at com.splunk.dbx.info.DatabaseList.invoke(DatabaseList.java:34)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:92)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:30)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException
at net.sourceforge.jtds.ssl.TdsTlsInputStream.readFully(TdsTlsInputStream.java:137)
at net.sourceforge.jtds.ssl.TdsTlsInputStream.primeBuffer(TdsTlsInputStream.java:100)
at net.sourceforge.jtds.ssl.TdsTlsInputStream.read(TdsTlsInputStream.java:78)
at sun.security.ssl.InputRecord.readFully(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at
... View more
07-14-2016
02:05 PM
Thanks, adding this to the hipchat.py worked!
... View more
07-14-2016
12:28 PM
I downvoted this post because i tried this, restarted splunk, and it is not working for me. after reviewing hipchat.py, i'm not sure the how this would work anyway.
... View more
04-08-2016
11:05 AM
2 Karma
I've found at least one search in the Splunk App for Windows Infrastructure that doesn't support Perfmon:Mk sourtypes, which is what you get when configuring perfmon inputs with the mode = mutlikv setting. For now, I've restored my perfmon inputs to use mode = single.
This is frustrating because I found not using multikv setting has increased my license usage by 5x.
... View more
04-07-2016
10:21 AM
I can't seem to find any information out there and I was just curious if anyone out there knows for sure before I mess up my configs.
... View more
04-06-2016
09:05 AM
I had an issue with the lookup generation apparently failing. It was failing because at one point I had removed the default admin account. I've run into similar issues in the past and have since added the account rather than change the owner on all the default reports, etc.
... View more
