Is the Splunk 7.0.0 version compatible with Splunk DB Connect 2.4.0?

[naliniasb]

Can anyone verify if DB Connect 2.4.0 is capable of running with Splunk 7.0.0?

I am planning to upgrade Splunk Enterprise 7.0.0 but not sure Splunk DB Connect 2.4.0 is compatible or not.

Is there any matrix or table for Splunk DB app connect version?

[nickhills · Accepted solution]

The challenge that you face is that 2.4.0 is no longer 'supported' since it has been replaced by dbx 3.x

This means that it is really only a question of 'does it work' not 'is it supported'

If my memory serves, I had a deployment which was using 2.4 on Splunk 7 so my failing memory says "yes i think so" however you really should be testing these changes in a test/pre-prod environment.

Personally I would spin up a test instance with your target versions on it and thoroughly test that it behaves as you require.
I would also be very tempted to move DBX to 3.1.4 which IS supported on 6.6 and 7.x

[nickhills]

Actually - 3.2.0 is supported on versions later than 6.6, so that would be my target DBX version.
https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Prerequisites

[naliniasb]

Thanks nickhillscpl.

[nickhills]

Glad to have helped. Please accept the answer or let me know if you need anything further.

[naliniasb]

We tried installing splunk_db_connect_app version 3.1.4 for splunk enterprise 7.3.0, but getting error as
"Cannot communicate with task server, please check your settings."

**** An exception was thrown while dispatching the python script handler. ****

So tried below solutions and restarted the sever but we are still facing the same issue.
Solution1:
Tried to fix this issue by changing port number from 9998 to 1025 in below stanza of "dbx_task_server.yml" file.
server:
rootPath: /api/
applicationConnectors:
- type: http
port: 9998

Solution2:
tried to change keystore_password parameter from changeme to * as value in inputs.conf file
[server://default]
config_file = ${SPLUNK_HOME}/etc/apps/splunk_app_db_connect/config/dbx_task_server.yml
interval = 5
keystore_password = *
start_by_shell = false

Solution3: editied dbx_settings.conf file by changing javahome path in {SPLUNK_HOME}/etc/apps/splunk_app_db_connect/local folder

[java]
javahome = /opt/app/java/jdk/jdk180_51

Kindly help us here .

[naliniasb]

In addition to this we are getting below error in splunk internal log for every 20 minutes after executing the query : index=_internal host=zlp09255 sourcetype=dbx_server error=*

2020-01-28 01:59:52.292 -0600 31205@xxxx [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US

[nickhills]

Is this an upgrade fro m a working Dbx 2.x?

[naliniasb]

We have renamed the existing Dbx 2.x(splunk_app_db_connect_backup) and deployed new DBx(splunk_app_db_connect) of version 3.1.4 and we have verified the current DBx 3.1.4 app in the UI as well.

[nickhills]

There is specific documentation on migrating DBX 2 -> 3 here:
https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/MigratefromDBConnectv1

and a useful troubleshooting guide here:
https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Troubleshooting

[nickhills]

Have you verified that java has not been updated, and that is still the correct path?
/opt/app/java/jdk/jdk180_51
That does not look like a valid path to the JRE - but perhaps it is correct for your distro?

Also, as a side note once you have resolved the task server issue - as you have effectivly 'reinstalled' DBX you may need to obtain the relevent DB driver for your database engine. See this:
https://docs.splunk.com/Documentation/DBX/3.2.0/DeployDBX/Installdatabasedrivers