Splunk DB Connect - Cannot Communicate With Task Server

Applicability

Description

When logging into Spunk, users encountering an error messages in the UI for the DB Connect App - "Cannot communicate with task server, please check your settings".

The Splunk DB Connect server won't be initialised and errors are available in splunkd about the splunk_app_db_connect. 

Investigation

Below are the logs that were observed in Splunkd.log


06-03-2024 20:46:41.957 +0000 ERROR ExecProcessor [797464 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:137)\\com.splunk.DefaultServerStart.streamEvents(DefaultServerStart.java:66)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.command.DbxQueryServerStart.main(DbxQueryServerStart.java:28)\\06-03-2024 20:46:41.958 +0000 ERROR KVServiceClient [1940709 TcpChannelThread] - KVServiceClient transaction failed after 0 retries. uri = https://rsoc-asula-dev.api.scs.splunk.com/rsoc-asula-dev/kvstore/v1beta1/collections, networkError="No error", httpStatusCode=409, httpStatusDescription="Conflict", requestID=a629966d-8b35-9bcc-9cc7-797ff710deef, message = "resource already exists"06-03-2024 20:46:41.958 +0000 ERROR CollectionConfHandler [1940709 TcpChannelThread] - Failed to create collection: resource already exists06-03-2024 20:46:41.961 +0000 ERROR ExecProcessor [797464 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/server.sh" action=task_server_start_failed error=com.splunk.HttpException: HTTP 500 -- Failed to create collection: resource already exists 

Looking at the above logs, it seems the collections.conf file was not created in the backend.

Resolution

To resolve this issue, user can perform the steps as mentioned below:

Navigate to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local

Create a `collections.conf` file and add the following stanza:

[secret]
field._key = string
field.value = string[dbx_db_input]
field.appVersion = string
field.columnType = number
field.inputName = string
field.timestamp = string
field.value = string