Snowflake DB Logs Not Ingested or Searchable in Splunk DB Connect Due to JDBC Driver Certificate Issue

Applicability

Description

Splunk DB Connect inputs are configured and appear to be working, however logs from Snowflake databases are not being ingested or are not searchable in Splunk’s Search Head. Queries may appear to successfully pull events, but the data does not show up in Splunk.

Investigation

1. Symptom Validation

   • Verified that Snowflake DB Connect inputs were operational, but events were not appearing in Splunk searches.
   • Confirmed that disabling and enabling DB inputs did not change the outcome.

2. Log Analysis

   • Examined Splunk DB Connect logs and identified error messages, including:
     • Run Db Input name= INPUT_NAME failed, status=500. There was an error processing your request.
     • JDBC driver encountered communication error. Message: (certificate_unknown) No trusted certificate found.
   • Determined that the communication failure was related to a certificate trust problem in the JDBC driver.

3. Testing

   • Attempted to resolve the issue by replacing the JDBC driver (from version 3.24 to 3.28.0).
   • After upgrading, confirmed that data ingestion resumed and events became searchable in Splunk.

Resolution

1. Download and Replace the JDBC Driver:

   • Download the latest supported Snowflake JDBC driver (version 3.28.0) from the official source:
     • JDBC 3.28.0 Download
     • Release Notes
     • Download Instructions
   • Stop Splunk DB Connect.
   • Replace the old JDBC driver .jar file with the new version (3.28.0) in the appropriate directory.
   • Restart Splunk DB Connect.

2. Verify Data Ingestion:

   • Run the DB input again and confirm that events from the Snowflake database are now ingested and visible in Splunk searches.

3. Monitor and Prevent Future Issues:

   • Always verify compatibility and certificate requirements for JDBC drivers before upgrading Splunk DB Connect integrations.
   • Regularly monitor Splunk DB Connect and Snowflake JDBC release notes for known issues and supported versions.
   • Maintain a record of driver updates and related certificates in use.

Related Links

Snowflake JDBC 3.28.0 Download

Snowflake JDBC Release Notes

Snowflake JDBC Download Instructions