All Apps and Add-ons

DBX output Alert action from Splunk DB Connect- How to resolve this error?



We are trying to use Splunk DB connect app's "Outputs" option to insert data in MySQL table.  For this we are using DBX output alert action  in Splunk alert and calling the "Output" from  Splunk db connect app.

Followed the below steps:

1) Created a new Output named "insertdb_cronjob" under "Outputs" Option in Splunk db connect app

2) Created an alert and  

3) Added the trigger actions as DBX output alert action where its calling  "insertdb_cronjob" to insert data into MySQL table.

4) Manually execution is working fine but when the alert is triggered, getting below error in internal logs:

10-28-2022 12:00:01.960 +0530 INFO  sendmodalert [3425498 AlertNotifierWorker-0] - Invoking modular alert action=alert_output for search="si_alert" sid="rt_scheduler__admin_c3BsdW5rX2FwcF9kYl9jb25uZWN0__RMD5f6c0cb1e9f4fe73f_at_1666933094_23674.0" in app="splunk_app_db_connect" owner="admin" type="saved"

10-28-2022 12:00:02.065 +0530 ERROR sendmodalert [3425498 AlertNotifierWorker-0] - action=alert_output STDERR -  Error: Could not find or load main class com.splunk.dbx.command.DbxAlertOutput

10-28-2022 12:00:02.068 +0530 INFO  sendmodalert [3425498 AlertNotifierWorker-0] - action=alert_output - Alert action script completed in duration=105 ms with exit code=1

10-28-2022 12:00:02.068 +0530 WARN  sendmodalert [3425498 AlertNotifierWorker-0] - action=alert_output - Alert action script returned error code=1


Can you please suggest if we are missing anything.



Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...