All Apps and Add-ons

DB Connect runs every query multiple times

asuprun
New Member

When running any query against SQL Server using "Splunk DB Connect" I see that the query always executed 4 times instead of just one. Only result of the 3rd execution is returned and displayed to the client. This behavior can be easily verified either by using SQL Server Profiler or by running this query:

IF OBJECT_ID('dbo.TESTTABLE') IS NULL
BEGIN
CREATE TABLE dbo.TESTTABLE(id int)
INSERT dbo.TESTTABLE(id) VALUES(1)
END
SELECT * FROM dbo.TESTTABLE
UPDATE dbo.TESTTABLE SET id = id + 1

I would expect the result to be "1" but I see "3" instead. Next execution will return 7, 11, 15 and so on, instead of 1,2,3...

I don't see why it's necessary and would consider it as a major bug. Running very expensive queries against production databases takes a lot of resources already but running it 4 times takes precisely 4 times more resources. That's simply unacceptable.

Splunk Version ............................................7.2.0
Splunk Build ............................................8c86330ac18

Current Application: Splunk DB Connect
App Version ............................................3.1.3
App Build ............................................55

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you in a clustered environment? If so, on which Splunk instance did you install DB Connect?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...