I have installed Splunk DB Connect 2 on a heavy forwarder, but why does the Health Dashboard show no data?

[tomaszwrona]

Hello,

I have installed Splunk DB Connect 2 on a heavy forwarder and the queries with Oracle DB are working fine.
My question is, however, how can I see something in the Health Dashboard?
The health log is written permanently, but the searches in dashboard show no data. I have checked the local indexes and they are empty.

How can I visualize the health data for the Splunk DB Connect app?

Best regards
Tomasz

[MMCC]

Hi Tomasz,
are you running a distributed environment or a single one?

Does your outputs.conf send all the data to the indexer?
If yes, then there will be no local copy on the forwarder and thus the information is only available on the indexer.

To enable the forwarder to see the data you will have to add it as a "search head". If you only have one indexer you can do this via GUI in the Settings > Distributed search > Search peers. Add here the indexer to the forwarder.
If you have two indexers including the master node you will have to add both.
The easiest way is to execute this command (adding the forwarder as searchhead to the master):
$SPLUNK_HOME/bin/splunk edit cluster-config -mode searchhead -master_uri https://master_node_name:8089 -secret your_secret -auth admin:pwd

Make sure not to add the forwarder to the search head cluster! Otherwise the data will now be replicated here aswell!

I hope the solutions help you. Would like to know if it resolves your situation.