All Apps and Add-ons

MongoDB dbxquery timeout waiting to connect

esecules
Engager

I am executing several queries to MongoDB through DBConnect (v3.1.4) and UnityJDBC driver. I'm experiencing issues getting results for anything but the simplest SQL queries. All queries take a very long amount of time compared to when I run the same SQL queries through a UnityJDBC client.

Here's an example of the kinds of queries that are able to return results

QuerySplunk Exec TimeUnityJDBC Client Exec Time
SELECT COUNT(_id) FROM docs8 - 40 sec0.1 sec
SELECT * FROM docs WHERE status='ERROR'20 - 40 sec

0.06 sec

 

Now if I try to use dbxquery to execute any join queries or anything slightly more complex than the above I get the following error:

 

 

 

 

 

com.mongodb.MongoTimeoutException: Timed out after 30000 ms while waiting to connect. Client view of cluster state is {type=UNKNOWN, servers=[{address=/dev-db:27017, type=UNKNOWN, state=CONNECTING, exception={com.mongodb.MongoSocketException: /dev-db}, caused by {java.net.UnknownHostException: /dev-db}}]

 

 

 

 

 

 

Here's a couple of examples of queries which work in UnityJDBC's client, but fail in splunk after roughly 30 seconds yielding the above error.

 

 

 

 

 

SELECT * FROM StatusHistory  WHERE CAST(ModifiedOn, 'DATE') > '2020-08-07'
SELECT * FROM StatusHistory sh JOIN docs d ON sh.doc_id = d.id
SELECT Status, COUNT(Status) FROM StatusHistory GROUP BY Status HAVING COUNT(Status) > 6

 

 

 

 

 

 
I don't believe there is an intermittent network issue causing this because the queries that fail always fail in the same way and the queries that produce results always produce results (sometimes after greater than 30 seconds if there are enough concurrent dbxqueries on the system).

What could be causing the timeout?
In the error log it looks like the host address is missing some data, like an IP address or a hostname. It's strange this is only happening for the more complex queries and not for everything.

Why are dbxqueries so slow compared to a JDBC Client connected to the same database?

Labels (1)

dennywebb
Path Finder

I am having this same issue trying to connect.  Specifically, this is connecting to a Cosmos DB on Azure/Docker if this matters.  Can connect fine from StudioT3.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...