Cannot Connect to Database - Splunk DB Connect

[rogue_carrot]

Hello Team Splunk,

I am trying to use the Splunk DB Connect plug-in: https://splunkbase.splunk.com/app/2686/#/details. I have configured the JRE, the JAR for the JDBC connection (Figure 1), the identity with the username and password for the connection. However on the screen where I test the connection I always receive an I/O error, Figure 2. So this tells me that the connection is not working. 😕

Is there some type of log I can check to try and pinpoint what is going wrong? I thought maybe there was a firewall issue but I can ping the computer the database is on. I thought the issue was with the JRE but I uninstalled the openjdk JRE from the operating system and installed one from Oracle dot com. I thought maybe the issue was with the "Connection Type" on the "New Connection" screen but the connection fails whether I specify "Oracle" or "Oracle Service".

What am I doing wrong?

Thank-you for reading this.

Regards,

rogue_carrot

Figure 1: JDBC URL Settings

Figure 2: IO Error: The Network Adapter could not establish the connection

[richgalloway · Accepted solution]

Check your firewalls as possible timeout causes.

Splunk monitors its own logs by default so you shouldn't need to set up anything.

[rogue_carrot]

Yes, I need to fill out a firewall request form in my organization. This is a firewall issue indeed. Thank-you for the help with this Rich.

[richgalloway]

@rogue_carrot If your problem is resolved, please accept the answer to help future readers.

[richgalloway]

DB Connect has its own set of log files. Search "index=_internal sourcetype=dbx*".

Ping is not a good indication of the ability to connect to a service. Try using telnet or curl as they let you specify a port as well as an address.

Make sure the Oracle version is supported by DB Connect.

[rogue_carrot]

Hello Rich!

Thank-you sir for the reply. I noticed this Linux machine does not have the telnet program so I am using the curl program. I received a time out connection error when trying to curl to this database server. 😕 Thank-you for the idea on how to trouble shoot this problem with the curl program. Now if I could figure out why there is a timeout error.

Also, where or how would I set up the logging on this enterprise version of Splunk to search for the logs you are writing about with, "index=_internal sourcetype=dbx*"?