Splunk DB Connect: Rising inputs query returns "error code 1. Script output = "RuntimeError: Failed to run query" - how to fix?

[nialldonnelly]

Can anyone help please? I can't get a rising input query to work at all. Batch Inputs work fine. Rising Inputs always gives me this error:

External search command 'dbxquery' returned error code 1. Script output = "RuntimeError: Failed to run query: "SELECT * FROM (select * from (SELECT BWTXNID,CURRENCY FROM ALANK_HOSTTXNREQUEST order by bwtxnid) {{WHERE $rising_column$ > ?}}) t", params: "None", caused by: Exception(' java.sql.SQLException: Missing IN or OUT parameter at index:: 1.',). "

[Yunjiamin]

External search command 'dbxquery' returned error code 1. Script output="RuntimeError,Failed to run Query 'SELECT * FROM (SELECT * FROM
'ActivePortal'. 'public'.'np_user_history_v')t',caused by:
BadStatusLine('").'

[Yunjiamin]

这个问题怎么解决的后来？

[nialldonnelly]

I think you might be better off creating a new question for this, the error looks a little different to (my) original error of "Missing IN or OUT parameter". The original question is not valid for later DB Connect versions and fixed per my comments. In a new question add what DB Connect version being used, what DB type, and is this only happening on one input, or everywhere? Before you do, maybe look at why you need quotes inside the select statement, are they needed or can you get it to work without them?

[richgalloway]

Try this slightly simplified query.

SELECT BWTXNID,CURRENCY FROM ALANK_HOSTTXNREQUEST  {{WHERE $rising_column$ > ?}} order by bwtxnid

[nialldonnelly]

That was actually my original query but it gets the same error. I had reformatted it based on other suggestions on the forums but I keep getting that error.

[nialldonnelly]

After a bit of delay, just getting back to this. I noticed that if I use the actual column name in advanced mode (where BWTXNID > ?), the SQL command works as expected, returning rows after the value provided. But it gives the error when using the double parenthesis nor the $rising_column$. I'm wondering if, because it is DB Connect v2.3, I no longer need the double parenthesis and $rising_column$? When I look here, I do not see any mention of $rising_column$ that is mentioned in many previous answers, http://docs.splunk.com/Documentation/DBX/2.3.1/DeployDBX/Createandmanagedatabaseinputs.

[Richfez]

What database are you pointing it to? MSSQL, MySQL, Oracle?

Also, I don't think you need the order by clause in your sql statement.

[nialldonnelly]

Hi, It's Oracle 11.2.0.4 Enterprise Edition. I only added the order by after days of trawling thru loads of peoples responses to rising column issues and that was something suggested.