Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1

[rapmancz]

Hello, I am getting "Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1."  for every search in Splunk DB connect app.  Already configured inputs are indexed, but when I try to run any searches by hand, I always get this failure. I can not also add any new input.

I am using Splunk DB connect 3.4.2 with MySQL database.  The data is indexed so I am sure the connection is working, I can also select 

[David888]

I had this issue today. I tried the few things suggested here. None fixed my problem. I looked in the _internal index for possible error messages. I found  "The certificate chain length (11) exceeds the maximum allowed length (10)"

I changed the limit to 15 and my issue was fixed. 
Under Configurations -> Setting  -> Query Server JVM Options 
I entered -Djdk.tls.maxCertificateChainLength=15

--Hope this helps 

[thuhuongle]

Hi,
I have faces the same error with version 3.4.0. After verification installed drivers  (JDBC connetion and java home path). We did upgrade to 3.6.0 and restart Splunk. Problem resoved.

[AshChakor]

I am getting same error after upgrading  to Splunk 8.1.3 version. we don't have commands.conf under local. Any suggestions please? 

Thanks in advance!

[rahmatn]

Have you find it under default ? 

[rahmatn]

in my case just put "#" in front of

[dbxquery]

filename = java.path

in local/commands.conf

[FreelanceRob]

Solved! Thank you very much!

[martaBenedetti]

Same problem, worked for me!

Thanks a lot rahmatn!

[resmungo]

Same here. Thank you!

[hpbrand]

Hi, had the same problem.  After weeks of troubleshooting I found following entry under default/commands.conf

####### uncomment following lines to revert dbxquery to 3.2.0 version
# [dbxquery]
# run_in_preview = false
# filename = java.path
# chunked = true
# command.arg.1 = -Dlogback.configurationFile=../config/command_logback.xml
# command.arg.2 = -DDBX_COMMAND_LOG_LEVEL=INFO
# command.arg.3 = -cp
# command.arg.4 = ../jars/dbxquery.jar
# command.arg.5 = com.splunk.dbx.command.DbxQueryCommand

Gave it  a try and copied all over to local/commands.conf and it works.