Deployment Architecture

Connect to another server via ODBC

redc
Builder

We are attempting to integrate a QuickFill (QF) database with Splunk for reporting purposes; by default QF prefers ODBC for database connections. Our QF database lives on one server while the Splunk indexer lives on another server.

Everything I've found about ODBC so far seems to indicate that you can only connect Splunk to an ODBC database that lives on the same server as the Splunk indexer itself. Is this true, or is there something I'm missing? Do I need a forwarder set up on the QF server to plug into its database and then push the data to the indexer (rather than having the indexer pull the data)?

Tags (2)

redc
Builder

I'm currently attempting to connect to a local QF database via ODBC.

I have upgraded to Splunk 6 which seems to have resolved the timeout issue. However, I continue to receive this error when attempting to search/access the database through DB Connect:

Error getting database connection: [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

Example command that generates this error:
| dbinfo tables database="QFDEMO" schema="*"

0 Karma

krugger
Communicator

I have had some trouble with DB Connect in the past, so I just use python scripts to query remote database servers, fetch the results and echo them to the terminal, so the a scripted input can place it in Splunk.

redc
Builder

This ODBC connection timing out has also broken the DB Connect app in general, causing it to time out for everything. I had to disable the ODBC external database we'd set up.

0 Karma

redc
Builder

I installed QuickFill Workstation on the Splunk server in order to get the QF ODBC driver. Once I had that, I was able to set up the System DSN.

I was also able to save the ODBC database connection in DB Connect, but only by disabling the "Validate Database Connection" option; it was timing out, "Encountered the following error while trying to update: Splunkd daemon is not responding: ('The read operation timed out',)"

When I was filling out the database connection, it was able to connect well enough for "Fetch database names" to work, so I'm not sure why it's timing out on saving.

0 Karma

lukejadamec
Super Champion

Is there a special odbc driver that you need to place in the dbx/bin/lib directory?

0 Karma

redc
Builder

Yes, but I get an error:

[Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified

Clarification: This is the information I'm filling out:
Database type: ODBC
Host: [QF server's IP address]
Port: 1433
Username/password as appropriate

The "Fetch database names" button doesn't do anything, so I put "QuickFill DEMO Database" (the name of the database on the QF server) in and try to save. That's when I get that error.

0 Karma

lukejadamec
Super Champion

Have you looked into using the db connect app?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...