Splunk DB Connect + Oracle - data isn't importing

[kpavan]

Hi,

I have configured Splunk DB Connect input in version 3.1.1 both batch and raising column. But none of them are collecting data/importing data from Oracle connection. While configuring am not getting any errors and am able configure data input without any issues. But still am not getting the data in Splunk.

All I get is below message in Splunk internal log for the same connection & input. Could you please help me find issue?

2017-08-31 09:08:50.764 +0000 INFO  c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=Corp_Prod_DB jdbc_url=jdbc:oracle:thin:@x.x.x.x:1521:prddb status=FAILED input_name=FSA_CERT batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2017-08-31_09:08:33 end_time=2017-08-31_09:08:50 duration=16986 read_count=0 write_count=0 filtered_count=0 error_count=0

2017-08-31 09:08:43.700 +0000 INFO  c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=Corp_Prod_DB jdbc_url=jdbc:oracle:thin:@x.x.x.x:1521:prddb status=FAILED input_name=FSA_Certification batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2017-08-31_09:08:33 end_time=2017-08-31_09:08:43 duration=9908 read_count=0 write_count=0 filtered_count=0 error_count=0

[kulsplunk]

Hi, I am having the similar issue. I hope your issue got resolved, and it would be great if you can share the resolution. Thanks!

[traxxasbreaker]

How are you setting up your timestamp on that input? I find that with Oracle inputs in particular the preview mode of DB Connect will show timestamps in nice human readable formats, but in a lot of cases the timestamp column has to actually be configured as an epoch time instead of the time format that it looks like in the preview mode. Otherwise, I've seen similar behavior to what you're describing in which it can be configured without issues and seems to run but nothing is ever ingested. Depending on the DB Connect version there may or may not be log messages mentioning an inability to parse a timestamp, but I find it's usually at least worth a try to set the timestamp format to "Epoch" to see if that makes anything come through.