Database Module troubleshooting

Verify Index Data

Verify add-on setup and input configuration is done properly for the DB Connect 2, Windows and Unix/Linux by searching for index, sources, and source types.

Add-on	Example Index Verification Search
DB Connect 2	index=* source="dbx2"
Add-on for Windows	index="windows" OR index="wineventlog" OR index="perfmon"
Add on for Unix and Linux	index="os"

The table below displays searches that can verify module entity and KPI data.

	Verification Search
Entity	|savedsearch DA-ITSI-DATABASE-Database_Instances_Search
KPI	index=* tag=database tag=performance<field>=* Note: Check fields used for Database KPIs, (deadlock_rate, instance_read_iops, instance_write_iops, response_time, connections, connection_pool_used_percent, transaction_rate).

Cannot connect to database using DB Connect 2

To connect to your database using DB Connect 2, the corresponding JDBC driver needs to be copied over to the C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\lib location. For SQLServer, you can download the driver from the SQLServer web site.

Cannot conduct MySql Database Queries on mysql_variables

MySql Database Queries on mysql_variables fail if @@global.show_compatibility_56 is not set. To fix this issue: Run set @@global.show_compatibility_56 to "ON" against the MySql database in question.

Query data delay

If you experience query data delays when using Splunk DB Connect 2 with the Splunk Add-on for Oracle, this issue could happen because of:

• Network issues between your Oracle server and your Splunk platform deployment.
• Dropped connectivity between your Splunk platform deployment and Splunk DB Connect 2.

The problem exists only with query data. All other inputs (oracle:database, oracle:connections) generate data normally. Query data might not be found for several hours, but data will eventually appear. Restarting your Splunk can also speed up this process.

Entities not found

When you are unable to locate operating system entities, see ITSI module troubleshooting section on entities.

Troubleshooting entity appearance speed

It will take about an hour to start seeing a full sparkline chart and for KPIs to become active. For more information, see entity appearance speed.

Metrics not collected

If you are unable to view your data, run the data model audit to make sure your data models are processing your data.

If you are running into issues seeing your KPI data, see ITSI module troubleshooting section on KPIs.

User Permissions

If a user encounters a permission-related obstacle, the issue could be related to their assigned role.

ITSI permissions are determined by the role that each user has. Each role offers a different set of user permissions.

See ITSI module troubleshooting to learn about permissions within ITSI.

Learn about adding navigation to a Splunk app.