topic Re: Splunk DB Connect Tail Input command not working in Splunk Search

Splunk DB Connect Tail Input command not working

scc00 — Tue, 08 Jan 2013 16:42:44 GMT

Hi,

I'm trying to use the Tail command for Splunk DB Connect to pull the newest logs into a Splunk Index. Unfortunately, it is not pulling the data, even when I generate new logs. I have tried the DUMP option which works just fine but duplicates the entire database each dump so I don't want to use it. I have configured the Tail option as noted within the documentation and have used the same configurations as I used with the DUMP option but it still does not work. I am not using any specific SQL query either. What am I doing wrong?

Re: Splunk DB Connect Tail Input command not working

pmagee — Tue, 08 Jan 2013 20:41:58 GMT

One thing I'm discovering is that the "rising column" and "log date" column names must be specified in ALL CAPS or they won't be recognized. There may be other issues with your particular query as well. I got some insight from checking the $SPLUNK_HOME/var/log/splunk/dbx.log file.

Re: Splunk DB Connect Tail Input command not working

scc00 — Mon, 28 Sep 2020 13:04:22 GMT

Well I tried the CAPS option with no results. Though I did check the dbx.log file and found two SQL exceptions. I'm checking with my DBAs but I doubt the database is full. Any other thoughts?

dbx5836:WARN:PooledConnectionFactory - Pooled Connection validation failed: com.splunk.dbx.sql.Database$DatabaseValidationException: Error validating database: java.sql.SQLException: I/O Error: No space left on device
dbx5836:ERROR:TailDatabaseMonitor - Error while executing database monitor: java.sql.SQLException: The column "ERR_ADD_DATE" is not present in the result set

Re: Splunk DB Connect Tail Input command not working

pmagee — Wed, 09 Jan 2013 14:47:50 GMT

Based on your errors it looks like your connection to the database is failing. I would suspect that there is a space shortage in the database, probably in regards to the audit trail. The audit trail can't expand, so the login fails, which is why the column doesn't show up in the result set.

Re: Splunk DB Connect Tail Input command not working

scc00 — Thu, 10 Jan 2013 20:49:41 GMT

That's probably correct but after a database restart, it started working. I can't say that I can say what the real solution was though. Which is annoying.