All Apps and Add-ons

Splunk DB Connect Version 3 Inputs on Search Heads

Venkat_16
Contributor

We have DB Connect Version 2 on our Search Head Cluster. We face frequent Connection refused Error Code 111
and would like to move to DB Connect Version 3.

From the Splunk DB Connect Version 3 documentation, we understand that DB Inputs needs to moved to Heavy Forwarders.
We currently do NOT have Heavy Forwarders in our infrastructure.

We have DB Batch inputs, can we use like below and run as scheduled report instead?

| dbxquery ... | collect ...

Is this OK to implement this? Has anyone tried like this and were successful? Should we live with DB Connect Version 2?

0 Karma

Richfez
SplunkTrust
SplunkTrust

Are you using search head clustering or just individual search heads? (It makes no difference if you hae or do not have indexer clustering, that's not a problem, only search head clustering).

0 Karma

Venkat_16
Contributor

We have Search Head Cluster and we have scheduled DB inputs in current version DB Connect v2. We want to upgrade to v3, however still like to have the scheduled DB inputs on the search heads, because we do not have heavy forwarders.

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...