I'm currently trying to set up a lookup against a SQL Server DB using dblookups.
I went through the UI for DB Connect 2 and set up the lookup. Everything works fine, the UI suggestions and previous and all properly populated, but when it comes to the "Preview Your Lookup" the new column that I want is blank.
I checked that the value I'm using for my key does exist on the database and it does.
One thing I noticed is that the field in the DB is defined as an int, which may be confusing to Splunk?
Guessing at which ticket is being referenced... but if I'm seeing the right one, the root cause appears to be time. Preview tasks have one time range, lookup cache inputs have another, and the source data may or may not line up as expected. Does that make sense in your case muebel?
Although the preview functionality might be bugged, do you get any data once you've established the input? Can you run test queries against the database?
I've tried running test queries against the database and I'm still having issues pulling back data using the connection. It seems to now want to use my search peers (the indexers) to do the query execution. This ends up failing because DBXv2 isn't installed on the Indexers. I no longer have issues with the lookups because I can't get that far. I was originally getting an issue with DBXv2.0.4 where no lookup data was returned. Now I can't even get data to return from my SQL Query.
DB Connect doesn't belong on Indexers... I don't know if you're seeing a misconfiguration or a bug, but that's not desired behavior.
Yup. That's why I only put it on the Search Heads. I also tried it on a standalone search head (i.e. no search peers defined) and it worked to query the DB and return data from the DB. When I added the search peers in (i.e. the indexers) to the distributed search configs, it started returning this:
[name_of_indexer_1of10] Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'dbxquery' ,
I'm having this issue as well. All troubleshooting and documentation has been provided as part of a Splunk case. Fortunately, support was able to replicate the issue and has opened a bug with development however I was not provided the bug-ID nor an indication as to when it would be fixed.