All Apps and Add-ons

Splunk DB Connect 2: Is it possible to establish an Oracle DB Connection with a tnsnames.ora entry?

heiko_seip
Explorer

Hello,

is there a possibility for a tnsnames.ora entry to establish the connection?

Then through a customized "jdbcUrlFormat = ..." so connect.
jdbcUrlFormat = jdbc: oracle: thin: @ //

Would like to connect via Splunk on a scan Oracle listener.
About sqlplus is not a problem "sqlplus USER_SPLUNK @ TNS_NAMES_ENTRY" works.
Or you can use the tnsnames.ora entry directly into the Splunk config?

Many thanks for your help,
Heiko

1 Solution

pmdba
Builder

If you are connecting to a SCAN address, then you don't need the complex TNSNAMES entry. The whole point of SCAN is to move the load balancing and failover complexity to the server and out of the client configuration. SCAN handles the load balancing and failover parameters can be defined a a part of each service name. Then you can simply use the JDBC-Thin driver with the SCAN hostname and the Oracle service name to connect, as described in this post.

Potentially you could also alter the connect string prototype in the db_connection_types.conf file to use a JDBC-Thick (OCI) connection, something like this:

jdbcUrlFormat = jdbc:oracle:oci:@TNSALIAS

This would allow you to use TNSNAMES, say to define a connection string with SOURCE_ROUTE, enable strong network encryption, or to use LDAP resolution instead of tnsnames.ora. I have made similar changes with other applications designed to use the Thin connection with no problem, but I have not tested such a configuration with Splunk and I'm not sure if it would work. Perhaps someone from Splunk could comment on that configuration, and whether or not is has ever been tested...

View solution in original post

pmdba
Builder

If you are connecting to a SCAN address, then you don't need the complex TNSNAMES entry. The whole point of SCAN is to move the load balancing and failover complexity to the server and out of the client configuration. SCAN handles the load balancing and failover parameters can be defined a a part of each service name. Then you can simply use the JDBC-Thin driver with the SCAN hostname and the Oracle service name to connect, as described in this post.

Potentially you could also alter the connect string prototype in the db_connection_types.conf file to use a JDBC-Thick (OCI) connection, something like this:

jdbcUrlFormat = jdbc:oracle:oci:@TNSALIAS

This would allow you to use TNSNAMES, say to define a connection string with SOURCE_ROUTE, enable strong network encryption, or to use LDAP resolution instead of tnsnames.ora. I have made similar changes with other applications designed to use the Thin connection with no problem, but I have not tested such a configuration with Splunk and I'm not sure if it would work. Perhaps someone from Splunk could comment on that configuration, and whether or not is has ever been tested...

heiko_seip
Explorer

oh yeah thats works for me, with the servicename.

Thanks so lot and kind regards,
Heiko 🙂

heiko_seip
Explorer

tnsnames.ora:

TNS_NAMES_ENTRY =
(DESCRIPTION_LIST= (LOAD_BALANCE=off) (FAILOVER=on)
    (DESCRIPTION = (CONNECT_TIMEOUT=5)(TRANSPORT_CONNECT_TIMEOUT=10)(RETRY_COUNT=3)
                (ADDRESS_LIST=(LOAD_BALANCE=on)
                (ADDRESS = (PROTOCOL = TCP)(HOST = host1a-scan)(PORT = 1234))
                )
        (CONNECT_DATA=
                (service_name=DB_SERVICE)
        ))
    (DESCRIPTION = (CONNECT_TIMEOUT=5)(TRANSPORT_CONNECT_TIMEOUT=3)(RETRY_COUNT=3)
                (ADDRESS_LIST=(LOAD_BALANCE=on)
                (ADDRESS = (PROTOCOL = TCP)(HOST = host5a-scan)(PORT = 1234))
                )
        (CONNECT_DATA=
                (service_name=DB_SERVICE)
        ))
)
0 Karma

heiko_seip
Explorer

thanks for the support, I am puzzled why I get no connect.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...