All Apps and Add-ons

Adding firebird database connection to Splunk DB Connect

idsiano
Explorer

I'm trying to add a new Firebird database connection through DB Connnect app.
I followed the best practice indicated by splunk db connect:

  1. downloaded and copied the jar's jdbc firebird driver into D:\Splunk\etc\apps\dbx\bin\lib
  2. copied and paste D:\Splunk\etc\apps\dbx\local\database_types.conf and added new stanza:

    [firebird]
    displayName = Firebird
    jdbcDriverClass = org.firebirdsql.jdbc.FBDriver
    defaultPort = 3050
    connectionUrlFormat = jdbc:firebirdsql://{0}:{1}/{2}
    testQuery = SELECT 1 AS test
    after the restart of splunk, I don't found the new database type when I'm going to add a new one connection.
    It seems that splunk is ignoring the new type, or isn't understanding correctly my edit to database_types.conf.

Maybe I'm missing to modify other config files?

D:\Splunk\var\log\splunk\dbx.log isn't reporting any error, only INFO msgs.

Tags (1)
0 Karma

sandipan11
Path Finder

I also face the same problem. Then I have change permission of this file to 775 and restart the server

0 Karma

idsiano
Explorer

Permissions? Good to know: I'll make another temptative and I'll will keep you up to date.
I had another similar problem related to the permission: javaBridge not running, than I discovered that DBX folder files were not accessible for reading to everyone user. (the splunk server is running on a win7-64 machine that was in NT Domain)

0 Karma

sandipan11
Path Finder

Then it is started to show. I did this for Tera data

0 Karma

idsiano
Explorer

Partially solved.

Strange: any edit to \local\database_types.conf doesn't be read by splunk. I edited directly the \default\database_type.conf and the new connection appeared.

Whan I'm creating the new connection with firebird jdbc driver, I get this error:

File "D:\Splunk\etc\apps\dbx\bin\spp\java\bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 1\n

So I decided to switch to system ODBC DSN and it worked.

Unfortunately it is a workaround, it doesn't explain if the error is a bad configuration, javaBridge-side or jaybidrd-side.

0 Karma

idsiano
Explorer

I'm still available for debugging activities and digging into this error: in case someone could drive me, please contact me.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...