All Apps and Add-ons

Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1

rapmancz
Explorer

Hello, I am getting "Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1."  for every search in Splunk DB connect app.  Already configured inputs are indexed, but when I try to run any searches by hand, I always get this failure. I can not also add any new input.

I am using Splunk DB connect 3.4.2 with MySQL database.  The data is indexed so I am sure the connection is working, I can also select image.png

Labels (1)
Tags (1)
0 Karma

David888
Engager

I had this issue today. I tried the few things suggested here. None fixed my problem. I looked in the _internal index for possible error messages. I found  "The certificate chain length (11) exceeds the maximum allowed length (10)"

I changed the limit to 15 and my issue was fixed. 
Under Configurations -> Setting  -> Query Server JVM Options 
I entered -Djdk.tls.maxCertificateChainLength=15

 

--Hope this helps 

0 Karma

thuhuongle
Explorer

Hi,
I have faces the same error with version 3.4.0. After verification installed drivers  (JDBC connetion and java home path). We did upgrade to 3.6.0 and restart Splunk. Problem resoved.

0 Karma

AshChakor
Path Finder

I am getting same error after upgrading  to Splunk 8.1.3 version. we don't have commands.conf under local. Any suggestions please? 

Thanks in advance!

0 Karma

rahmatn
Path Finder

Have you find it under default ? 

0 Karma

rahmatn
Path Finder

in my case just put "#" in front of

[dbxquery]

filename = java.path

in local/commands.conf

FreelanceRob
Engager

Solved! Thank you very much!

0 Karma

martaBenedetti
Path Finder

Same problem, worked for me!

Thanks a lot rahmatn!

0 Karma

resmungo
Explorer

Same here. Thank you!

0 Karma

hpbrand
Explorer

Hi, had the same problem.  After weeks of troubleshooting I found following entry under default/commands.conf

####### uncomment following lines to revert dbxquery to 3.2.0 version
# [dbxquery]
# run_in_preview = false
# filename = java.path
# chunked = true
# command.arg.1 = -Dlogback.configurationFile=../config/command_logback.xml
# command.arg.2 = -DDBX_COMMAND_LOG_LEVEL=INFO
# command.arg.3 = -cp
# command.arg.4 = ../jars/dbxquery.jar
# command.arg.5 = com.splunk.dbx.command.DbxQueryCommand

Gave it  a try and copied all over to local/commands.conf and it works.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...