Where should I open firewall to connect the Splunk DB Connect App to the database (Indexer or Search Head) & what port?

[u2s1e0n2]

I recently installed the Splunk DB Connect App in a distributed environment. Splunk version is 6.5.3. The database I want to ingest MS SQL data on port 1433. I wanted to know where (search head or indexer) to open port 1433 to get connectivity to the database and DB Connect App?

[u2s1e0n2]

Thanks so much for the reply. How do I do that? I have 5 search heads (clustered) and the DBX was pushed out through the Deployer. Do I open outbound from the 5 Search heads (Clustered)? Also the how do I open the connectivity on the JDBC client? Any steps to follow?

Thanks

[s2_splunk]

You need to ensure that every SHC member has network connectivity to your database server. How you do that is completely dependent on your network environment, so I can't really answer that.
DBConnect uses whatever connection URL you specify.
Are you getting connection errors similar to what is described here?

[u2s1e0n2]

This is the error message.

The TCP/IP connection o the host 10.X.X.X port 1433 has failed. Error: ' Connection timed out: no further information . verify the connection properties. Make sure that an instance of SQl is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by firewall."

[s2_splunk]

This thread has the troubleshooting steps in it. Your network folks will be able to help you figure out why you cannot connect from sourceIP(SHC) to targetIP:1433
Most likely they need to put some firewall rules in place for you.

[s2_splunk]

Enable outbound connectivity on the host that runs DBX and the JDBC client.