db_connect: Why an error when trying to query basic select?

jotaforense — Mon, 21 Aug 2023 17:50:10 GMT

Hello,
I have an odd problem with db_connect :
My connection is ok

I can see the database and the tables but when i try to query (basic select) i have an error

Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

My query is

| dbxquery query="select * from aps.notifications " connection="PE"

even select 1 from dual doesn't work

Database : Oracle
User : root privileges
Splunk 7.0.0
DB connect 3.1.4
App Build 43

Re: I have an odd problem with db_connect

richgalloway — Fri, 03 Jul 2020 20:01:46 GMT

Verify you have the right driver installed for your target DB.
Check the search log (via job inspector) to see what details, if any, are reported about the error.

Re: I have an odd problem with db_connect

jotaforense — Fri, 03 Jul 2020 20:31:14 GMT

can i send the log?

Re: I have an odd problem with db_connect

richgalloway — Sat, 04 Jul 2020 17:23:43 GMT

You can post logs fragments here, but don't submit the entire search log as it is too large and probably contains private information. Just post the relevant entries.

Re: I have an odd problem with db_connect

jotaforense — Mon, 06 Jul 2020 13:02:22 GMT

look at the error log
the server name has been replaced.

[]

07-03-2020 13:10:28.195 ERROR ChunkedExternProcessor - stderr: 13:10:28.194 111194@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
.....

07-03-2020 13:10:28.341 ERROR ChunkedExternProcessor - stderr: 13:10:28.337 111194@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:29.073 ERROR ChunkedExternProcessor - stderr: 13:10:29.073 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:29.074 ERROR ChunkedExternProcessor - stderr: 13:10:29.074 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 79 ms to rescan all jdbc drivers
07-03-2020 13:10:29.141 ERROR ChunkedExternProcessor - stderr: 13:10:29.138 111281@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
07-03-2020 13:10:29.152 ERROR ChunkedExternProcessor - stderr: 13:10:29.149 111194@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60

.....

07-03-2020 13:10:29.245 ERROR ChunkedExternProcessor - stderr: 13:10:29.244 111281@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US

.....

07-03-2020 13:10:29.775 ERROR ChunkedExternProcessor - stderr: 13:10:29.774 111315@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed

.....

07-03-2020 13:10:29.877 ERROR ChunkedExternProcessor - stderr: 13:10:29.876 111315@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:30.310 ERROR ChunkedExternProcessor - stderr: 13:10:30.310 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:30.311 ERROR ChunkedExternProcessor - stderr: 13:10:30.311 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 63 ms to rescan all jdbc drivers
07-03-2020 13:10:30.390 ERROR ChunkedExternProcessor - stderr: 13:10:30.389 111315@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60
07-03-2020 13:10:30.641 ERROR ChunkedExternProcessor - stderr: 13:10:30.641 111315@vukoo-br [main] WARN c.s.d.c.c.impl.JdbcConnectorImpl - fetch size value reached the allowed max value, MAX_FETCH_SIZE_ALLOWED=10000
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: 13:10:30.800 111315@vukoo-br [main] ERROR c.s.d.c.c.impl.JdbcConnectorImpl - action=fail_to_close_connection error=Protocol violation
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newArray(Native Method)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newInstance(Array.java:75)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.BufferCache.get(BufferCache.java:212)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.PhysicalConnection.getCharBuffer(PhysicalConnection.java:7698)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.prepareAccessors(OracleStatement.java:1013)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receiveCommon(T4CTTIdcb.java:277)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receive(T4CTTIdcb.java:146)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.readDCB(T4C8Oall.java:916)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:421)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:227)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:531)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:208)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:886)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:1175)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1288)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3613)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3657)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeQuery(OraclePreparedStatementWrapper.java:1495)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.JdbcConnectorImpl.executeQuery(JdbcConnectorImpl.java:291)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.OracleConnectorImpl.executeQuery(OracleConnectorImpl.java:41)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.generate(DbxQueryCommand.java:308)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.process(GeneratingCommand.java:183)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.ChunkedCommandDriver.execute(ChunkedCommandDriver.java:102)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.AbstractSearchCommand.run(AbstractSearchCommand.java:50)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.run(GeneratingCommand.java:15)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.main(DbxQueryCommand.java:234)
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - EOF while attempting to read transport header
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

.....

07-03-2020 13:10:30.835 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

Re: I have an odd problem with db_connect

richgalloway — Mon, 06 Jul 2020 14:26:05 GMT

Have you verified you have the correct driver for your DB?
See if this helps: https://arjunkrajan.wordpress.com/tag/splunk/

Re: I have an odd problem with db_connect

jotaforense — Mon, 06 Jul 2020 14:54:49 GMT

I'll check!

Re: I have an odd problem with db_connect

rapmancz — Thu, 04 Feb 2021 13:23:00 GMT

@jotaforense How did you solve it? I have exactly the same issue (with MySQL database), select=1 also does not work, Splunk 8.1 on Windows server 64bit, existing database inputs are working fine but I am not able to add any new one because of this failure....

Re: I have an odd problem with db_connect

jotaforense — Fri, 18 Aug 2023 19:57:21 GMT

@rapmancz , I believe the problem resolved when I updated the db_connect driver.

topic Re: I have an odd problem with db_connect in All Apps and Add-ons

db_connect: Why an error when trying to query basic select?

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect

Re: I have an odd problem with db_connect