topic Re: DB Connect Quit Working in Splunk Search

DB Connect Quit Working

kmcconnell — Sat, 01 Feb 2014 03:29:04 GMT

All database connections quit working at the same time. I have checked the splunkd.log, dbx.log, and the jbridge.log and do not see any errors. When I restart Splunk I see in the dbx.log where it loads all the monitors and executes them, but then nothing shows up after that except the following two lines every few minutes. Any ideas would be MUCH appreciated!!

2014-01-31 19:31:00.740 dbx3877:INFO:Splunkd - Splunkd REST Keep-alive successful for user admin
2014-01-31 19:31:00.740 dbx3877:INFO:ExecutionContext - Execution finished in duration=0 ms

Re: DB Connect Quit Working

linu1988 — Sat, 01 Feb 2014 07:36:21 GMT

Did you check the account which you are using if locked or not? Which database connection are you using? Try running some queries it will throw some exceptions, figure out what may cause the issue.

Re: DB Connect Quit Working

lukejadamec — Sat, 01 Feb 2014 13:32:58 GMT

Can you query the databases from DB Connect > Query?
Can you open and save the DB Connect > Database Inputs without error?

Re: DB Connect Quit Working

kmcconnell — Sat, 01 Feb 2014 15:07:06 GMT

All the connections are Microsoft SQL Server. On the “External Databases”, when I try to re-save the connection I get the following error at the top of the page.

“Encountered the following error while trying to update: Splunkd daemon is not responding: (‘The read operation timed out’)

If I take one of the existing queries and modify it to only return a few rows, it just sits there and never returns anything.

Re: DB Connect Quit Working

lukejadamec — Sat, 01 Feb 2014 18:44:23 GMT

Is the java bridge server running? If not, open taskmgr and stop the service. It sounds like java is hung, and I've seen this before where not even a reboot of the computer would fix the problem, but a manual kill of the java process would.

Re: DB Connect Quit Working

lukejadamec — Mon, 03 Feb 2014 13:03:24 GMT

One other thing, you have to be running a query in DB Connect when you kill java. Java will automatically restart, and the query should error out with a code 47, but when you run the query again it should work.

Re: DB Connect Quit Working

kmcconnell — Mon, 03 Feb 2014 13:36:15 GMT

lukejadamec put me on right track (if was a Java issue). I had to kill the java process being run by Splunk. After I restarted, DB connected worked correctly. Thanks!

Re: DB Connect Quit Working

reed_kelly — Mon, 03 Feb 2014 13:56:54 GMT

Could it have been a java memory problem? What did you have for -Xmx in the java bridge options?

Re: DB Connect Quit Working

reed_kelly — Mon, 03 Feb 2014 13:59:02 GMT

Also, did you try the TDS driver. It can do Integrated Security as well and may be better written.

Re: DB Connect Quit Working

linu1988 — Mon, 03 Feb 2014 17:32:47 GMT

it was a issue with older dbx, upgrade to the latest version if not done.