DBConnect is not indexing data

[mhornste]

Dear community,

I'm running DBConnect v2 2.3.0 in Splunk 6.4.1

The problem is, that no data from DBConnect v2 is indexed. If I run the queries manually, I receive a result. I can see the DB Inputs in DBConnect v2 and am able to finish the wizard (4 steps): the SQL can be executed successfully. Even the sourcetype and index are correct. Unfortunately, no data is showing up. dbx.log is empty. The Input is not disabled.

Something is strange by the way: the input worked until yesterday noon. From that time on, it didn't work. I had DBConnect v2 v2.2 installed. I just updated to 2.3 since some new inputs didn't work when I added them using inputs.conf (had to go through the wizard).

This is my input sample:

[mi_input://DTreeNotify]
connection = CS_ORACLE_SERVER2
index = otcs
interval = 60
max_rows = 10000
mode = batch
output_timestamp_format = dd-MM-yyyy HH:mm:ss
query = SELECT count(*) FROM "COBRA971PRD"."DTREENOTIFY"
sourcetype = OtcsDTreeNotify
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = COBRA971PRD
ui_query_table = DTreeNotify
disabled = 0

Any help is appreciated.

Thanks,

Martin

[dlisicre]

Hi mhornste,

at least in my case, the error was converting the sid of output.

Changing output_timestamp_format = dd-MM-yyyy HH:mm:ss to epoch type managed to solve my issue, although am not sure if the same fix would apply to you.

Hope it helps,

 David Lisin

[mhornste]

dbx2.log.29160901 says:

2016-09-01T15:07:18+0200 [ERROR] [modular_input_event_writer.py], line 102: action=converting_incoming_data_in_csv_to_event_stream_failed input_mode=batch dbinput="mi_input://DTreeNotify" error="invalid literal for float(): 1472735238,704"

The SQL returns by default an integer.

[dlisicre]

Good afternoon mhornste, did you manage to solve this issue?