All Apps and Add-ons

Splunk 7.0.0 and DBConnect 3.1.1 not working -- new install

xdp4
Explorer

Brand new CentOS 7 system with Splunk 7, DBConnect 3.1.1 and Java JDK 1.8.0_144. Splunk starts fine, DBconnect installs fine, but when I go to access the app, I just get the message Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code 127).

I can't even access the controls to configure the DBconnect app, I just get the little circling spokes with the splunk controls at the top of the window.

I've tried wiping Splunk and reinstalling to see if it was an issue with the Java install, but same results. Has anyone else run into this with new the version of Splunk?

alexsayegh
Explorer
0 Karma

xdp4
Explorer

I'm uncertain as to what the underlying cause might be, I wiped the system this morning and installed with Ubuntu 16.04LTS. Fresh install of Splunk 7, installed the DBConnect app, and exact same behavior. To those suggesting modification to the firewall, it's not a firewall issue as I can connect to the Splunk web frontend and see the same results.

0 Karma

dvergnes_splunk
Splunk Employee
Splunk Employee

I was able to install successfully this environment:
- CentOS Linux release 7.0.1406 (Core)
- JDK build 1.8.0_144-b01
- Splunk 7.0.0 build c8a78efdd40f
- DB Connect 3.1.1 build 34

The only thing to mention is to open the 8000 port:

firewall-cmd --zone=public --add-port=8000/tcp
0 Karma

hkumar8
Explorer

I was experiencing same and then had to install dbconnect 2 and was working fine.

0 Karma

rafamss
Contributor

Hi @xdp4,

I've passed for the same problem and I resolved this issue enabling the port (9998 or any that you want) in the firewall in my CentOS 7.

firewall-cmd --zone=public --add-port=9998/tcp --permanent

I hope help you.

[ ]s
Rafael Martins

0 Karma

dvergnes_splunk
Splunk Employee
Splunk Employee

Hi,

Can you try to run DB Connect installation's health checks, please? To run them you need to go to your monitoring console > Health Check and then select the app DB Connect. You can also use this URL http://your_host:8000/en-US/app/splunk_monitoring_console/monitoringconsole_check

0 Karma

xdp4
Explorer

I don't see a DB Connect Installation Health dashboard, but the DB Connect Connection Health shows no stats. Probably because I can't actually configure the app or setup db connections.

0 Karma

dvergnes_splunk
Splunk Employee
Splunk Employee

Can you try to visit the page mentioned earlier by accessing the following URL http://your_host:8000/en-US/app/splunk_monitoring_console/monitoringconsole_check ?

Can you have a look on splunkd.log? You need to search for the string "server.sh" in this file to find relevant logs about your issue.

0 Karma

xdp4
Explorer

From splunkd.log: 10-09-2017 14:04:32.774 -0400 WARN ExecProcessor - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" com.splunk.modularinput.MalformedDataException: Events must have at least the data field set to be written to XML.
10-09-2017 14:04:32.774 -0400 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/splunk_app_db_connect/linux_x86_64/bin/server.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:134)\com.splunk.dbx.server.bootstrap.TaskServerStart.streamEvents(TaskServerStart.java:76)\com.splunk.modularinput.Script.run(Script.java:66)\com.splunk.modularinput.Script.run(Script.java:44)\com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:149)\

Visiting the URL just shows the word LOADING... with no controls or inputs available

0 Karma

dvergnes_splunk
Splunk Employee
Splunk Employee

If you cannot access the Monitoring Console page, it seems not to be a problem from DB Connect. I suggest you to contact our support to help you with the installation.

0 Karma

xdp4
Explorer

I only get a blank screen with the word Loading... in it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...