topic Re: Splunk DB Connect Error - NullValuePointerException in Splunk Search

Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 04 Apr 2014 22:49:13 GMT

I am getting this error on some data I am trying to push into a Teradata database:

command="dboutput", Unexpected error while performing dboutput: java.lang.NullPointerException

This is a little confusing, mostly because when I do a search of the data without the | dboutput command there are not any NULL fields.

This is the Log

2014-04-04 17:42:02.188 dbx8261:ERROR:SQLInsertHandler - Error occurred while performing database output: java.lang.NullPointerException
java.lang.NullPointerException
2014-04-04 17:42:02.188 dbx8261:INFO:Database - Rolling back changes...
2014-04-04 17:42:02.434 dbx8261:ERROR:DatabaseOutputCommand - Error while executing command: Unexpected error while performing dboutput: java.lang.NullPointerException
2014-04-04 17:42:02.434 dbx8261:INFO:BridgeSession - Execution finished in duration=3640 ms with status=0
2014-04-04 17:42:02.435 dbx8261:INFO:ExecutionContext - Execution finished in duration=3642 ms

Is there anything I can do to get more information on this error? I have JDK 1.7 u51 installed on the server. Additionally, I have 16GB dedicated to the JVM.

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 04 Apr 2014 23:59:56 GMT

Also, in the target database, all of the fields are nullable. I have put data in this database with and without null fields.

Re: Splunk DB Connect Error - NullValuePointerException

linu1988 — Sat, 05 Apr 2014 07:20:51 GMT

i guess it tells you the db object doesn't exist. Java is not able to find the object.

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Sat, 05 Apr 2014 23:13:40 GMT

That cannot be the case because the objects are always present in the target database. It appears to be affecting it for single 1 minute periods of time.

Re: Splunk DB Connect Error - NullValuePointerException

btsay_splunk — Mon, 07 Apr 2014 16:42:40 GMT

may I have more information about the settings, the dboutput parameters in this case?

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Thu, 10 Apr 2014 21:54:16 GMT

dboutput type=insert streaming=true database=teradata_archmessage table=ArchMessage key=ArchMessageID notFound=ignore

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 11 Apr 2014 17:58:54 GMT

Was that enough information or do you need more?

Re: Splunk DB Connect Error - NullValuePointerException

linu1988 — Fri, 11 Apr 2014 18:27:11 GMT

did you try the simple query approach?

| dboutput streaming=true  type=sql database=test table=ArchMessage "insert into r_table (field) values ('$field_value$')"

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 11 Apr 2014 18:34:39 GMT

Tried both ways, same result either way...

Re: Splunk DB Connect Error - NullValuePointerException

araitz — Mon, 14 Apr 2014 18:01:19 GMT

If you haven't already, can you please open a support case?

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 18 Apr 2014 22:13:26 GMT

How would I open a case? With Splunk or with the Splunk DB Connect developer? I do not see Splunk DB Connect listed in the drop-down on the Support Portal.

Re: Splunk DB Connect Error - NullValuePointerException

linu1988 — Sat, 19 Apr 2014 02:36:19 GMT

It's Splunk who has developed the app so a case can be opened with any option.

Re: Splunk DB Connect Error - NullValuePointerException

araitz — Tue, 22 Apr 2014 22:16:24 GMT

That is correct, if you open a case with Splunk support it will be routed to the appropriate resources.

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 06 Jun 2014 16:06:47 GMT

It was a problem with the way Splunk handled the .jar file for Teradata. There is a setting that needs to be passed to the odbc connector that the DBX app does not currently have the ability to pass.

Re: Splunk DB Connect Error - NullValuePointerException

araitz — Fri, 06 Jun 2014 16:10:05 GMT

Let me know what that setting is, I haven't seen any bug on this. If you let me know I'll try to ensure this gets addressed.

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 06 Jun 2014 16:14:10 GMT

It is the setting to pass the max size in characters of the "CLOB" size to be inserted. The default in the odbc jar is 65K, I needed to update it to 2M.

Re: Splunk DB Connect Error - NullValuePointerException

ShaneNewman — Fri, 06 Jun 2014 16:16:07 GMT

I doubt anyone else will run into the issue. The only reason I did is because we are using Splunk to load entire HL7 messages into a Teradata database for disease reporting.