Splunk DB Connect: How to resolve error "ERROR org.easybatch.core.job.BatchJob - Unable to open record reader java.io.IOException: Push back buffer is full"?

[carlkennedy]

I have recently installed Splunk DB Connect 3.0.2 and I am trying to work with a MySQL database. I am able to use SQL Explorer in the Data Lab tab and can view rows from my table. The identity is not set for Read Only. I am running a job where I output search results into my table. When the job runs, it throws this error:

2017-04-28 12:37:22.884 -0400  [QuartzScheduler_Worker-3] ERROR org.easybatch.core.job.BatchJob - Unable to open record reader
java.io.IOException: Push back buffer is full
    at java.io.PushbackInputStream.unread(PushbackInputStream.java:232)
    at java.io.PushbackInputStream.unread(PushbackInputStream.java:252)
    at com.splunk.InsertRootElementFilterInputStream.<init>(InsertRootElementFilterInputStream.java:85)
    at com.splunk.ResultsReaderXml.<init>(ResultsReaderXml.java:82)
    at com.splunk.ResultsReaderXml.<init>(ResultsReaderXml.java:59)
    at com.splunk.dbx.server.dboutput.recordreader.DbOutputRecordReader.export(DbOutputRecordReader.java:82)
    at com.splunk.dbx.server.dboutput.recordreader.DbOutputRecordReader.open(DbOutputRecordReader.java:75)
    at org.easybatch.core.job.BatchJob.openReader(BatchJob.java:117)
    at org.easybatch.core.job.BatchJob.call(BatchJob.java:74)
    at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

I do have Splunk DB Connect 3.0.2 running on a non-prod box with the exact same MySQL database, table and credentials and it can write to the table which tells me this is not a permissions issue.

[hexxamillion]

Were you able to resolve this? What did you find out?

[mhoogcarspel_sp]

In Splunk support I've seen a few "Push back buffer is full" where reducing the amount of data returned (by limiting the timeframe of returned events in the search) solved the issue.

[hexxamillion]

Can you elaborate on this a bit more? I am getting the FAILED error as well when trying to output to a table. The same job for the past few days worked fine. It seems to be intermittent I guess. Anyone know a cause for this? I have the latest version of DB Connect and running Splunk 7.2.

[jan_lukasz]

Hello,

Did you finally solved your issue ?