All Apps and Add-ons

Splunk DB Connect: Why is data taking too long to show on dashboards?

mohammedk01
Explorer

I have connected Splunk to MS SQL server and got the data using DB Connect and built a dashboard with that data.
Then 2 things happen:

1) It stopped indexing data from day 2 (I thought it was going to get real-time data).
2) The dashboard takes ages to run commands and give results (Is it common? Can anyone tell the reason?).

Prewin027
Explorer

Hi,

Check your DBConnect Connection Health from the DBConnect App to make sure connection status of the DBConnect App.
Is your dashboard running searches against Indexer or database? If it's from Indexer, make sure DBConnect is configured to ingest required data only from the database, and also use specific index table if your DB Input have larger data set.

0 Karma

KARANMALHOTRA
Path Finder
  1. Have you checked the cron schedule for the DBConnect DataLab? Also, is DBConnect app showing any errors?
    We had an issue where the port used by DBConnect was not running and so it had stopped executing the data labs.

  2. The dashboard running slowly should not be related to the DBConnect application as it will be fetching events from the Index and not the app. You might want to check if you have any performance issues on your Indexer(s).

0 Karma

sandeepmakkena
Contributor

Which version of Splunk are you using?

If you are using 7.2.x versions which had a number of CPU and memory implications. 7.2.4 addressed most of them.

You can try | noop search_optimization=false and see, Which I think would make your search a little better.

If you can share an example search you're using.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...