Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?

BP9906 — Fri, 13 Feb 2015 20:13:48 GMT

DB Connect has done this twice for me in the past couple weeks. The java bridge stops responding and the dbx.log shows these errors in the log.

2015-02-13 08:50:36.259 :ERROR:BridgeSession - Exception occurred while executing command: com.splunk.bridge.io.BridgeIOException: Header size of 8192 bytes exceeded!
com.splunk.bridge.io.BridgeIOException: Header size of 8192 bytes exceeded!
at com.splunk.bridge.session.BridgeExecutionInfo.readBridgeCommandHeader(BridgeExecutionInfo.java:56)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:65)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:30)
at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

After this I still see :

2015-02-13 11:44:28.743 dbx8237:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-02-13 11:44:28.743 dbx8237:INFO:ExecutionContext - Execution finished in duration=11 ms
2015-02-13 11:49:28.753 dbx2736:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-02-13 11:49:28.753 dbx2736:INFO:ExecutionContext - Execution finished in duration=6 ms
2015-02-13 11:54:28.765 dbx6739:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-02-13 11:54:28.765 dbx6739:INFO:ExecutionContext - Execution finished in duration=9 ms
2015-02-13 11:59:28.779 dbx1514:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-02-13 11:59:28.779 dbx1514:INFO:ExecutionContext - Execution finished in duration=11 ms

However, Going to the DBX Home page, the Java Bridge status show "Loading..." and all DB Queries have stopped responding.

Restarting Splunk (./bin/splunk restart) resolves the issue of course.

Any idea whats going on here?

Re: Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?

jcoates_splunk — Sat, 28 Mar 2015 21:26:35 GMT

We're working your ticket... but for posterity here, DBX 1.1.x has a limit on the size of query that can be used, at 8192 bytes.

Re: Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?

BP9906 — Thu, 03 Mar 2016 17:44:39 GMT

For an update here, DBX 1.x still has a 8192 byte size limit for the query. DBX 2.x doesnt support a default schema and wraps all queries in a select statement thereby making DBX 2.x not a feasible solution.

topic Re: Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"? in Deployment Architecture

Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?

Re: Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?

Re: Splunk DB Connect: Why does java bridge stop responding and getting error "Header size of 8192 bytes exceeded!"?