All Apps and Add-ons

I have an odd problem with db_connect

jotaforense
Loves-to-Learn

Hello,
I have an odd problem with db_connect :
My connection is ok

I can see the database and the tables but when i try to query (basic select) i have an error

Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

My query is

| dbxquery query="select * from aps.notifications " connection="PE"

even select 1 from dual doesn't work

Database : Oracle
User : root privileges
Splunk 7.0.0
DB connect 3.1.4
App Build 43

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Verify you have the right driver installed for your target DB.
Check the search log (via job inspector) to see what details, if any, are reported about the error.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jotaforense
Loves-to-Learn

can i send the log? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You can post logs fragments here, but don't submit the entire search log as it is too large and probably contains private information. Just post the relevant entries.
---
If this reply helps you, Karma would be appreciated.
0 Karma

jotaforense
Loves-to-Learn

look at the error log
the server name has been replaced.

[]

07-03-2020 13:10:28.195 ERROR ChunkedExternProcessor - stderr: 13:10:28.194 111194@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
.....

07-03-2020 13:10:28.341 ERROR ChunkedExternProcessor - stderr: 13:10:28.337 111194@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:29.073 ERROR ChunkedExternProcessor - stderr: 13:10:29.073 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:29.074 ERROR ChunkedExternProcessor - stderr: 13:10:29.074 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 79 ms to rescan all jdbc drivers
07-03-2020 13:10:29.141 ERROR ChunkedExternProcessor - stderr: 13:10:29.138 111281@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
07-03-2020 13:10:29.152 ERROR ChunkedExternProcessor - stderr: 13:10:29.149 111194@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60

.....

07-03-2020 13:10:29.245 ERROR ChunkedExternProcessor - stderr: 13:10:29.244 111281@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US

.....

07-03-2020 13:10:29.775 ERROR ChunkedExternProcessor - stderr: 13:10:29.774 111315@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed

.....

07-03-2020 13:10:29.877 ERROR ChunkedExternProcessor - stderr: 13:10:29.876 111315@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:30.310 ERROR ChunkedExternProcessor - stderr: 13:10:30.310 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:30.311 ERROR ChunkedExternProcessor - stderr: 13:10:30.311 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 63 ms to rescan all jdbc drivers
07-03-2020 13:10:30.390 ERROR ChunkedExternProcessor - stderr: 13:10:30.389 111315@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60
07-03-2020 13:10:30.641 ERROR ChunkedExternProcessor - stderr: 13:10:30.641 111315@vukoo-br [main] WARN c.s.d.c.c.impl.JdbcConnectorImpl - fetch size value reached the allowed max value, MAX_FETCH_SIZE_ALLOWED=10000
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: 13:10:30.800 111315@vukoo-br [main] ERROR c.s.d.c.c.impl.JdbcConnectorImpl - action=fail_to_close_connection error=Protocol violation
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newArray(Native Method)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newInstance(Array.java:75)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.BufferCache.get(BufferCache.java:212)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.PhysicalConnection.getCharBuffer(PhysicalConnection.java:7698)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.prepareAccessors(OracleStatement.java:1013)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receiveCommon(T4CTTIdcb.java:277)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receive(T4CTTIdcb.java:146)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.readDCB(T4C8Oall.java:916)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:421)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:227)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:531)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:208)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:886)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:1175)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1288)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3613)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3657)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeQuery(OraclePreparedStatementWrapper.java:1495)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.JdbcConnectorImpl.executeQuery(JdbcConnectorImpl.java:291)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.OracleConnectorImpl.executeQuery(OracleConnectorImpl.java:41)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.generate(DbxQueryCommand.java:308)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.process(GeneratingCommand.java:183)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.ChunkedCommandDriver.execute(ChunkedCommandDriver.java:102)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.AbstractSearchCommand.run(AbstractSearchCommand.java:50)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.run(GeneratingCommand.java:15)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.main(DbxQueryCommand.java:234)
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - EOF while attempting to read transport header
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

.....

07-03-2020 13:10:30.835 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Have you verified you have the correct driver for your DB?
See if this helps: https://arjunkrajan.wordpress.com/tag/splunk/
---
If this reply helps you, Karma would be appreciated.
0 Karma

jotaforense
Loves-to-Learn

I'll check!

0 Karma

rapmancz
Explorer

@jotaforense How did you solve it? I have exactly the same issue (with MySQL database), select=1 also does not work, Splunk 8.1 on Windows server 64bit, existing database inputs are working fine but I am not able to add any new one because of this failure....

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...