It is ok to connect splunk to a MS SQL server running on dynamic port?

[Bonnieau1]

I tried to connect Microsoft SQL to Splunk by DB connect app. However, the TCPIP port 1433 refused the connection. The MS SQL server is running on dynamic port. there is no firewall to stop the connection within the domain.

[jkat54]

Dbconnect does not support dynamic ports.

[jkat54]

How do you connect to it from sql studio on your computer? What host/ip/protocol do you use?

There's multiple protocols for connecting to ms sql. Not a single of which is "dynamic". There's named pipes, there's tcp/ip which uses port 1433 typically, and then there's shared memory (only works on the same computer that is hosting the db). There's no other currently applicable protocols.

Which leads me to believe you're using named pipes. As far as I know, Splunk dbconnect does not support named pipes. You'll need to enable tcp/ip connections to the MS Sql server.

[Bonnieau1]

Hi, it is definitly TCP/IP protocol. However, the TCPIP is running on dynamic port, not fixed on default 1433 port. Do you know, if splunk DBX support MS SQL TCPIP dynamic port? If so, how to configure to use dynamic port? Microsoft MS SQL client will take care the dynamic port which works for the MS management studio connection. Does splunk can codnigured to use ODBC driver or talk to MS SQL client?

[woodcock]

What version of DB Connect (you should be on v3)? What do you mean by "dynamic port" (do you mean that sometimes it is #1433 and sometimes something else)? Can you Toad (or other tool) to it from your Heavy Forwarder?

[Bonnieau1]

The DB connect is the latest I downloaded last week. The MS SQL server is configured to running on dynamic port according to DBA. When create connection via Splunk DB connect, it say 1433 refused. However, DB may not run on 1433 as it changes from time to time. The Splunk DB connect doesn't allow to create connection without port number.
From Microsoft DB management studio, I can access MS SQL DB and run queries without any problem.

[woodcock]

But are you running Microsoft DB Management Studio on the same server as DBConnect (the Heavy Forwarder)?

[Bonnieau1]

Thanks for coming back. The Microsoft DB management studio is running my own laptop. I connect it remotely to the MS SQL Db server. They are not located in the same machine.

[woodcock]

Then there is no reason to believe that there is not firewall/ACL blocking connectivity from your Heavy Forwarder. Test from there with other software.

[Bonnieau1]

As I connect within the same domain, there is no firewall rule to brock conneciton within the same domain. However, the DB server may not running on 1433 port though. Splunk DBX appears always need a fix port to create connection. COuld this be the reason?
The TCP/IP connection to the host w0695, port 1433 has failed. Error: "Connection refused: no further information. Verify the connection properties. Make sure that an instance of SQL Server is running on the host and accepting TCP/IP connections at the port. Make sure that TCP connections to the port are not blocked by a firewall.".

[woodcock]

Connection Refused sounds like whitelisting problem in your DB Server (doesn't like incoming IP or bad PW).

[Bonnieau1]

Do you know if Splunk DBX support MS SQL server running TCPIP on dynamic port?