Snowflake: Error in 'dbxquery' command: No value present

[joshuaswink]

We're using Splunk DB Connect with the Snowflake add-on, and we're getting the following error message from queries:

Error in 'dbxquery' command: No value present

The first query after reconfiguring the connection is successful. Every query after that results in the above error. If I reconfigure the connection, another single query will work and then it's back to the error.

On the Snowflake side, every query from Splunk is logged as successful. We've also tried queries using a command-line database testing program on the same host as Splunk, using the same JVM, options, and credentials, and it was successful. Unfortunately, the Splunk DB Connect logs don't reveal much.

[sduong8 · Accepted solution]

Update: we were able to get this resolved (I'm joshuaswink's coworker).

For anyone running into this issue in the future, this appears to be an edge case code bug. We're running Splunk 10.0.1 + Splunk DB Connect 4.2.2 + Splunk DBX Add-on for Snowflake JDBC 1.2.4. We've been able to identify a workaround.

Conditions:

• You've created a Snowflake Connection.
• The credentials are a part of the JDBC URL.
• There are no firewalls blocking the connection to Snowflake.
• From Snowflake's side, it looks like the transactions were successful.

Symptoms:

• When you go to the Query Explorer and select the Connection, the Catalog, Schema, and Table will all populate correctly.
• Your first query after configuring the Connection may work. However, you will encounter the following error message if you try to make any more queries: "Error in 'dbxquery' command: No value present"
• See the splunk_app_db_connect_commands.*.log on the underlying system (e.g. at /opt/splunk/var/log/splunk/, or wherever it is for your system). You will find the following stack trace:

2026-03-24 12:48:56.916 Trace-Id=f8c20411-f4c4-4c77-aaea-2a921b387e5c [Query-Worker-50] ERROR com.splunk.dbx.command.DbxQueryServer - feature=query component=server action=handle_query status=failed message=dbx query server worker failed
java.lang.IllegalStateException: I/O operation on closed writer
at com.splunk.search.command.AbstractWriteHandler.checkValidity(AbstractWriteHandler.java:100)
at com.splunk.search.command.AbstractWriteHandler.flush(AbstractWriteHandler.java:228)
at com.splunk.search.command.ChunkedWriteHandler.flush(ChunkedWriteHandler.java:69)
at com.splunk.search.command.AbstractWriteHandler.close(AbstractWriteHandler.java:233)
at com.splunk.search.command.ChunkedCommandDriver.execute(ChunkedCommandDriver.java:120)
at com.splunk.search.command.AbstractSearchCommand.run(AbstractSearchCommand.java:50)
at com.splunk.search.command.GeneratingCommand.run(GeneratingCommand.java:15)
at com.splunk.dbx.command.DbxQueryCommand.runCommand(DbxQueryCommand.java:253)
at com.splunk.dbx.command.DbxQueryServer.lambda$handleQuery$3(DbxQueryServer.java:149)
at com.splunk.dbx.logging.MdcTaskDecorator.run(MdcTaskDecorator.java:23)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840) 

Workaround:

• Create an Identity and attach it to the Connection. This appears to avoid a check somewhere in the code that triggers this bug.

[kknairr]

@joshuaswink It looks like a session handling issue between Splunk DB Connect and Snowflake JDBC driver. You could try the below steps with the limited info you shared: [Test the below in dev or staging first before trying in prod]

• Enable DEBUG logging for DB Connect to confirm whether the issue is with connection reuse or any other issues. This is important from troubleshooting perspective to understand the root cause.
• If you see compatibility issues on debug logs, update the Snowflake JDBC driver to the latest version (v1.2.4) supported by DB Connect. Make sure to keep the DB Connect version is updated and compatible. Test in staging or dev first.
• Consider lowering maxConnLifetimeMillis to force connections to refresh more frequently and avoid stale sessions.
• Consider reducing idle connections so sessions don’t get stale. Review respective settings in reference documentation I shared.
• If the problem persists, raise a support case with Splunk sharing the debug logs and error we observed for faster troubleshooting.

Ref: db_connections.conf.spec | Splunk Enterprise, Splunk Cloud Platform (last updated 2025-09-02T22:34:0...

>>

If this post addressed your question, you can:

• Give it karma to show appreciation 👍
• Mark it as the solution if it solved your issue ✔️
• Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

>>