After upgrading from Splunk DB Connect 2.0.2 to 2.1.1, why are our database inputs no longer working?

[saikatr]

We have recently upgraded from Splunk DB Connect 2.0.2 to 2.1.1 to get around a known error with the previous version.

But now, none of our v2 database inputs are working anymore. While setting up a new database input (or even with the existing data inputs), we get the below error message on the screen when we try to run the SQL (in "Choose and preview table"):

Error message

-- External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/apps/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : java.io.EOFException" "

Is this a bug? The same SQLs work fine in DBX v1 (They were working in DBX v2 as well before upgrading).

[saikatr · Accepted solution]

My apologies. I have just discovered that DBConnect is not supported with Splunk free.

The environment where I have been testing this was a free license Test env.

[jkat54]

wow I didnt see that one coming! Thanks for the update!

[jkat54]

I dont know if it's possible but if you can please unmark my answer as the answer and mark your answer instead? I converted your comment to an answer, but I guess you'll have to change the accepted answer because I cant do that.

[ppablo]

done 🙂 thanks @jkat54

[jkat54]

Thanks Pablo!

[jkat54]

java input output End Of File exception means it didnt find the end of file it was looking for or end of file arrived before it received the required input it was looking for.

I'd start by troubleshooting the dbxquery command & drivers: http://docs.splunk.com/Documentation/DBX/2.1.1/DeployDBX/Troubleshooting#Troubleshoot_driver_connect...

Also note there were changes to dbxquery in the latest:
http://docs.splunk.com/Documentation/DBX/2.1.1/DeployDBX/WhatsnewinSplunkDBConnect

" You no longer have to URL encode your query, and dbxquery now returns up to 5000 rows."

[saikatr]

I took a look at the settings>drivers and saw that my oracle driver is unsupported. So I am going to downgrade from ojdbc7.jar to ojdbc6.jar

I had upgraded from ojdbc6.jar to ojdbc7.jar on the basis of the release notes of DBConnect 2.1.1-

2015-12-16 DBX-1786 Connection to Oracle database failed; the following error is logged in dbx2.log:
[ERROR] [ws.py] [DBInput Service] ERROR: statement handle not executed: getMetaData
Workaround: Replace the ojdbc6.jar with ojdbc7.jar JDBC driver. See this Splunk Answers post for details:

https://answers.splunk.com/answers/232978/error-wspy-dbinput-service-error-statement-handle.html

While elsewhere in the documents it clearly suggests only oracle 11g is supported and ojdbc6.jar should be used.

I am unsure why conflicting instructions are being published by Splunk in its docs.

I will update if going to ojdbc6.jar solves the issue for me.

[saikatr]

Just downgraded to ojadbc6.jar, now I am not seeing "unsupported" in settings>drivers. But I am still facing the same issue when I try to set up a data input.

Enter the SQL and hit the search button. After 5 seconds, a new error message

External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/apps/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : No rpc server enabled" "

turns up. I will open a case with Splunk support to see if they can help.