All Apps and Add-ons

Splunk DB Connect 3: How to resolve "HTTP Error 503: Service Unavailable" error on db input?

scelikok
SplunkTrust
SplunkTrust

DBInput from MSSQL database is not working because it cannot write records .

Can you help me how to fix this? Error log is below, Splunk version is 6.5.3 and Splunk DB Connect is the latest.

2017-04-28 13:41:02.548 +0300  [QuartzScheduler_Worker-3] ERROR org.easybatch.core.job.BatchJob - Unable to write records
java.io.IOException: HTTP Error 503: Service Unavailable
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:94)
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:71)
    at com.splunk.dbx.server.dbinput.task.processors.HecEventWriter.writeRecords(HecEventWriter.java:40)
    at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
    at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
    at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Collapse
host =  SplLab source = /opt/splunk/var/log/splunk/splunk_app_db_connect_server.log sourcetype =    dbx_server

Thank you...

If this reply helps you an upvote and "Accept as Solution" is appreciated.
1 Solution

scelikok
SplunkTrust
SplunkTrust

I found that the problem is on HTTP Event Collector itself. When I tested using curl, I got Server busy error.

I fixed this by removing "useDeploymentServer=1" parameter in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf.

Thanks to @starcher 's comment on "After configuring the HTTP Event Collector, why am I receiving a "Server is busy" error?" question.

Now DBConnect is working fine.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

I found that the problem is on HTTP Event Collector itself. When I tested using curl, I got Server busy error.

I fixed this by removing "useDeploymentServer=1" parameter in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf.

Thanks to @starcher 's comment on "After configuring the HTTP Event Collector, why am I receiving a "Server is busy" error?" question.

Now DBConnect is working fine.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...