Splunk® IT Service Intelligence


This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Database Module troubleshooting

Verify Index Data

Verify add-on setup and input configuration is done properly for the DB Connect 2, Windows and Unix/Linux by searching for index, sources, and source types.

Add-on Example Index Verification Search
DB Connect 2 index=* source="dbx2"
Add-on for Windows index="windows" OR index="wineventlog" OR index="perfmon"
Add on for Unix and Linux index="os"

The table below displays searches that can verify module entity and KPI data.

Verification Search
  • |savedsearch DA-ITSI-DATABASE-Database_Instances_Search
  • index=* tag=database tag=performance<field>=*

Note: Check fields used for Database KPIs, (deadlock_rate, instance_read_iops, instance_write_iops, response_time, connections, connection_pool_used_percent, transaction_rate).

Cannot connect to database using DB Connect 2

To connect to your database using DB Connect 2, the corresponding JDBC driver needs to be copied over to the C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\lib location. For SQLServer, you can download the driver from the SQLServer web site.

Cannot conduct MySql Database Queries on mysql_variables

MySql Database Queries on mysql_variables fail if @@global.show_compatibility_56 is not set. To fix this issue: Run set @@global.show_compatibility_56 to "ON" against the MySql database in question.

Query data delay

If you experience query data delays when using Splunk DB Connect 2 with the Splunk Add-on for Oracle, this issue could happen because of:

  • Network issues between your Oracle server and your Splunk platform deployment.
  • Dropped connectivity between your Splunk platform deployment and Splunk DB Connect 2.

The problem exists only with query data. All other inputs (oracle:database, oracle:connections) generate data normally. Query data might not be found for several hours, but data will eventually appear. Restarting your Splunk can also speed up this process.

Entities not found

When you are unable to locate operating system entities, see ITSI module troubleshooting section on entities.

Troubleshooting entity appearance speed

It will take about an hour to start seeing a full sparkline chart and for KPIs to become active. For more information, see entity appearance speed.

Metrics not collected

If you are unable to view your data, run the data model audit to make sure your data models are processing your data.

If you are running into issues seeing your KPI data, see ITSI module troubleshooting section on KPIs.

User Permissions

If a user encounters a permission-related obstacle, the issue could be related to their assigned role.

ITSI permissions are determined by the role that each user has. Each role offers a different set of user permissions.

See ITSI module troubleshooting to learn about permissions within ITSI.

Learn about adding navigation to a Splunk app.

Last modified on 28 April, 2023
Database Module data model reference table   About the End User Experience Monitoring Module

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters