topic Re: dboutput bug updating MySQL in Splunk Search

dboutput bug updating MySQL

richgalloway — Wed, 22 May 2013 15:54:45 GMT

I'm using DB Connect to send search results to MySQL. My search command is:

... | dboutput type=update notFound=insert database=mydb table=mytable fields=IPAddress AS ip, NetAddress AS mac, ComputerName AS device_name,
 Manufacturer AS manufacturer, Model AS model_name key=ip,mac *

This produces the error message "No value specified for parameter 1". Turning on debug logging I see the following query is generated:

UPDATE mytable SET `AS`=$AS$, ip=$ip$, NetAddress=$NetAddress$, ComputerName=$ComputerName$, Manufacturer=$Manufacturer$, Model=$Model$, mac=$mac$, IPAddress=$IPAddress$ WHERE ip = $ip$

Notice the 'AS' column was inserted. Where did it come from and how do I get rid of it?

Also, my key argument specified two fields, but only one appears in the query. Is that another bug or something I did wrong?

Re: dboutput bug updating MySQL

cramasta — Thu, 23 May 2013 21:29:36 GMT

I would be interested in knowing if you can actually provide two key values for the update to occur on.

Re: dboutput bug updating MySQL

cramasta — Thu, 23 May 2013 22:48:09 GMT

FYI, finding out that trying to use type=update will fail when Splunk results are more than 100 rows. Seems that type=insert is able to run batches of 100 but type=update doesn't know how to run batches and the max that will work is whatever the setting is in the java.conf file for batch size

Here is the error you would see ( i updated the batch size to 105 and tried exporting 108 rows, exporting 104 rows would work)

command="dboutput", Unexpected error while performing dboutput: java.lang.ArrayIndexOutOfBoundsException: 105

Re: dboutput bug updating MySQL

cramasta — Thu, 23 May 2013 22:49:14 GMT

trying to get my hands on the mysql connector, I dont think it has this limitation.

Re: dboutput bug updating MySQL

Dan — Wed, 05 Jun 2013 18:52:28 GMT

You can't currently have multiple key values for the update to occur on. This is one of the things we might add when we make dboutput GA.