topic Re: DBConnect is not indexing data in All Apps and Add-ons

DBConnect is not indexing data

mhornste — Tue, 29 Sep 2020 10:48:21 GMT

Dear community,

I'm running DBConnect v2 2.3.0 in Splunk 6.4.1

The problem is, that no data from DBConnect v2 is indexed. If I run the queries manually, I receive a result. I can see the DB Inputs in DBConnect v2 and am able to finish the wizard (4 steps): the SQL can be executed successfully. Even the sourcetype and index are correct. Unfortunately, no data is showing up. dbx.log is empty. The Input is not disabled.

Something is strange by the way: the input worked until yesterday noon. From that time on, it didn't work. I had DBConnect v2 v2.2 installed. I just updated to 2.3 since some new inputs didn't work when I added them using inputs.conf (had to go through the wizard).

This is my input sample:

[mi_input://DTreeNotify]
connection = CS_ORACLE_SERVER2
index = otcs
interval = 60
max_rows = 10000
mode = batch
output_timestamp_format = dd-MM-yyyy HH:mm:ss
query = SELECT count(*) FROM "COBRA971PRD"."DTREENOTIFY"
sourcetype = OtcsDTreeNotify
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = COBRA971PRD
ui_query_table = DTreeNotify
disabled = 0

Any help is appreciated.

Thanks,

Martin

Re: DBConnect is not indexing data

mhornste — Tue, 29 Sep 2020 10:48:24 GMT

dbx2.log.29160901 says:

2016-09-01T15:07:18+0200 [ERROR] [modular_input_event_writer.py], line 102: action=converting_incoming_data_in_csv_to_event_stream_failed input_mode=batch dbinput="mi_input://DTreeNotify" error="invalid literal for float(): 1472735238,704"

The SQL returns by default an integer.

Re: DBConnect is not indexing data

dlisicre — Fri, 02 Sep 2016 13:50:07 GMT

Good afternoon mhornste, did you manage to solve this issue?

Re: DBConnect is not indexing data

dlisicre — Tue, 29 Sep 2020 10:49:39 GMT

Hi mhornste,

at least in my case, the error was converting the sid of output.

Changing output_timestamp_format = dd-MM-yyyy HH:mm:ss to epoch type managed to solve my issue, although am not sure if the same fix would apply to you.

Hope it helps,

 David Lisin