All Apps and Add-ons

Splunk DB Connect 3: How to resolve "HTTP Error 503: Service Unavailable" error on db input?

scelikok
SplunkTrust
SplunkTrust

DBInput from MSSQL database is not working because it cannot write records .

Can you help me how to fix this? Error log is below, Splunk version is 6.5.3 and Splunk DB Connect is the latest.

2017-04-28 13:41:02.548 +0300  [QuartzScheduler_Worker-3] ERROR org.easybatch.core.job.BatchJob - Unable to write records
java.io.IOException: HTTP Error 503: Service Unavailable
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:94)
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:71)
    at com.splunk.dbx.server.dbinput.task.processors.HecEventWriter.writeRecords(HecEventWriter.java:40)
    at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
    at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
    at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Collapse
host =  SplLab source = /opt/splunk/var/log/splunk/splunk_app_db_connect_server.log sourcetype =    dbx_server

Thank you...

If this reply helps you an upvote and "Accept as Solution" is appreciated.
1 Solution

scelikok
SplunkTrust
SplunkTrust

I found that the problem is on HTTP Event Collector itself. When I tested using curl, I got Server busy error.

I fixed this by removing "useDeploymentServer=1" parameter in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf.

Thanks to @starcher 's comment on "After configuring the HTTP Event Collector, why am I receiving a "Server is busy" error?" question.

Now DBConnect is working fine.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

I found that the problem is on HTTP Event Collector itself. When I tested using curl, I got Server busy error.

I fixed this by removing "useDeploymentServer=1" parameter in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf.

Thanks to @starcher 's comment on "After configuring the HTTP Event Collector, why am I receiving a "Server is busy" error?" question.

Now DBConnect is working fine.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...