All Apps and Add-ons

Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1

rapmancz
Explorer

Hello, I am getting "Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1."  for every search in Splunk DB connect app.  Already configured inputs are indexed, but when I try to run any searches by hand, I always get this failure. I can not also add any new input.

I am using Splunk DB connect 3.4.2 with MySQL database.  The data is indexed so I am sure the connection is working, I can also select image.png

Labels (1)
Tags (1)
0 Karma

thuhuongle
Explorer

Hi,
I have faces the same error with version 3.4.0. After verification installed drivers  (JDBC connetion and java home path). We did upgrade to 3.6.0 and restart Splunk. Problem resoved.

0 Karma

AshChakor
Path Finder

I am getting same error after upgrading  to Splunk 8.1.3 version. we don't have commands.conf under local. Any suggestions please? 

Thanks in advance!

0 Karma

rahmatn
Path Finder

Have you find it under default ? 

0 Karma

rahmatn
Path Finder

in my case just put "#" in front of

[dbxquery]

filename = java.path

in local/commands.conf

FreelanceRob
Engager

Solved! Thank you very much!

0 Karma

martaBenedetti
Path Finder

Same problem, worked for me!

Thanks a lot rahmatn!

0 Karma

resmungo
Explorer

Same here. Thank you!

0 Karma

hpbrand
Explorer

Hi, had the same problem.  After weeks of troubleshooting I found following entry under default/commands.conf

####### uncomment following lines to revert dbxquery to 3.2.0 version
# [dbxquery]
# run_in_preview = false
# filename = java.path
# chunked = true
# command.arg.1 = -Dlogback.configurationFile=../config/command_logback.xml
# command.arg.2 = -DDBX_COMMAND_LOG_LEVEL=INFO
# command.arg.3 = -cp
# command.arg.4 = ../jars/dbxquery.jar
# command.arg.5 = com.splunk.dbx.command.DbxQueryCommand

Gave it  a try and copied all over to local/commands.conf and it works.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...