Splunk DB Connect on Windows Operating System Reports 'Cannot Communicate With Task Server' Error.

Applicability

Description

When logging into Spunk, users may encounter an error messages in the UI for the Splunk DB Connect - "Cannot communicate with task server, please check your settings". As a result, the Splunk DB Connect App fails to initialize correctly.

Investigation

Below is the SPL that can be used to check the logs:

index="_internal" sourcetype=splunkd splunk_app_db_connect log_level=ERROR host=""

Below are the logs that user might see in Splunkd:

ERROR ExecProcessor [2692 ExecProcessor] - message from ""D:\Program Files\Splunk\etc\apps\splunk_app_db_connect\windows_x86_64\bin\server.exe"" action=task_server_start_failed error=java.lang.ArrayIndexOutOfBoundsException: arraycopy: length -16 is negative stack=java.base/java.lang.System.arraycopy(Native Method)\\java.base/java.util.Arrays.copyOfRange(Arrays.java:4031)\\com.splunk.dbx.crypto.AesGcmEncryptor.decrypt(AesGcmEncryptor.java:49)\\com.splunk.dbx.crypto.EncryptionManager.decrypt(EncryptionManager.java:44)\\com.splunk.dbx.utils.SecurityFilesGenerator.getPlainKeystorePassword(SecurityFilesGenerator.java:216)\\com.splunk.DefaultServerStart.initialiseKeyManager(DefaultServerStart.java:93)\\com.splunk.dbx.server.bootstrap.TaskServerStart.startServer(TaskServerStart.java:71)\\com.splunk.DefaultServerStart.streamEvents(DefaultServerStart.java:60)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:36)\\

The above error message indicates a failure to start the task server. The specific error, java.lang.ArrayIndexOutOfBoundsException: arraycopy: length -16 is negative, suggests that there is an issue with array manipulation within the Java code, specifically during the decryption process.

Resolution

To address this issue, users can perform the steps as mentioned below:

• Removed keystore_password.dat file from $SPLUNK_HOME/etc/apps/splunk_app_db_connect/certs.
• Removed default.jks file from $SPLUNK_HOME/etc/apps/splunk_app_db_connect/keystore.
• Restart Splunk service.