https://community.splunk.com/t5/Security/Splunk-DB-connect-Intermittent-errors-with-oracle-driver/m-p/170470#M14719 <P>Tough to tell, but my guess is that this is on the Oracle DB side. It seems that ORA-28000 has given others fits in the past:</P> <P><A href="http://stackoverflow.com/questions/13230462/ora-28000-account-is-locked-error-in-qtp">http://stackoverflow.com/questions/13230462/ora-28000-account-is-locked-error-in-qtp</A></P> <P><A href="https://community.oracle.com/thread/2470425?tstart=0">https://community.oracle.com/thread/2470425?tstart=0</A></P> <P>My best guess is that something else, a script or command, is using the wrong password for this account and is intermittently locking it.</P> Mon, 03 Mar 2014 18:41:47 GMT araitz 2014-03-03T18:41:47Z https://community.splunk.com/t5/Security/Splunk-DB-connect-Intermittent-errors-with-oracle-driver/m-p/170469#M14718 <P>We are seeing couple of splunk db connect errors intermittently. We are using a latest version of DB connect (1.1.3 ) in our splunk 5.0.6</P> <OL> <LI>We have configured an external Database connection through Splunk DB connect.</LI> <LI>Through DB info within the Splunk DB connect, we are also able to look for schemas etc indicating a successful connection to the database.</LI> <LI>we have scheduled couple of searches in Splunk that queries this database and fetches the events into a Summary index.<BR /></LI> <LI>And we noticed that some of the search runs are giving one of the below errors intermittently. </LI> </OL> <P>2014-02-28 10:25:04.972 dbx7653:ERROR:DatabaseQueryCommand - Error while executing command: Database xxxxx does not exist! ( This database exists on search heads config file as well. Not sure if this needs to be configured on Indexers as well ? ). In one run, it complains about this error and in next run, it runs successfully indexing the events</P> <P>2014-02-28 11:00:53.843 dbx8200:ERROR:DatabaseQueryCommand - Error while executing command: Error getting database connection: ORA-28000: the account is locked. ( We are looking at the database end. But since this is intermittent, we would also like to check with Splunk support for any possible bugs ) </P> Fri, 28 Feb 2014 19:54:14 GMT https://community.splunk.com/t5/Security/Splunk-DB-connect-Intermittent-errors-with-oracle-driver/m-p/170469#M14718 venkatasajja 2014-02-28T19:54:14Z https://community.splunk.com/t5/Security/Splunk-DB-connect-Intermittent-errors-with-oracle-driver/m-p/170470#M14719 <P>Tough to tell, but my guess is that this is on the Oracle DB side. It seems that ORA-28000 has given others fits in the past:</P> <P><A href="http://stackoverflow.com/questions/13230462/ora-28000-account-is-locked-error-in-qtp">http://stackoverflow.com/questions/13230462/ora-28000-account-is-locked-error-in-qtp</A></P> <P><A href="https://community.oracle.com/thread/2470425?tstart=0">https://community.oracle.com/thread/2470425?tstart=0</A></P> <P>My best guess is that something else, a script or command, is using the wrong password for this account and is intermittently locking it.</P> Mon, 03 Mar 2014 18:41:47 GMT https://community.splunk.com/t5/Security/Splunk-DB-connect-Intermittent-errors-with-oracle-driver/m-p/170470#M14719 araitz 2014-03-03T18:41:47Z