Unable to Forward Spunk DB Connect Logs from HF to INDEXER.

Available Languages

Updated:September 29, 2026
Document ID:SPLK044996

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

User installed Splunk DB Connect add-on 3.3.1 in one of the heavy forwarders and they integrated Splunk DB Connect with Microsoft SQL Server 2016 (SP2-GDR) (KB4532097) - 13.0.5102.14 version. After the setup, they tried to run the SQL query in DB connect add-on and they were able to run it but the events they were unable to index the events.
 

FATAL HTTPServer - Could not bind to port 8088ERROR HTTPServer - Cannot set up accepts without binding ports firstERROR HttpInputServer - Failed to start HTTP Input serverERROR HttpInputServer - reconfigure returned an error HTTP Input data endpoint server cannot
be started.

Investigation

Reproduced the same Splunk version and the same DB connect add-on version and were able to receive the logs.


Resolution

In DB Connect 3.0.0, the architecture changed so that the JDBC driver returns the results to a Java thread. The Java thread calls the HTTP Event Collector (HEC) which then sends the results to splunkd and populates the indexers.

Change the HEC port from 8088 to 9088. 

After changing the port number restart the splunkd service
 


Splunk Documentation:
Debug HTTP Event Collector port issues
https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Troubleshooting#Debug_HTTP_Event_Collector_port_issues

 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles