All Apps and Add-ons

Splunk DBConnect Can't write data

tiagofbmm
Influencer

Hello All

DBConnect 3.1.3 is avoiding me to index data from Databases, although the input configuration actually works fine, I can see the query results.

But when the scheduled input runs on a regular basis, I get this error and data is never written to the index.

[QuartzScheduler_Worker-16] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
    at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
    at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
    at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
    at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Any ideas of workaround besides downgrading (by the way, the official downgrade would have to be to 2.4.1, not acceptable)

Any help?

Thank you in advance

0 Karma
1 Solution

tiagofbmm
Influencer

The bug is clear now: when I edit the url for the jdbc connection string, Splunk has the host field on the left empty (as it should as everything is done on the customized one). The problem is that Splunk is using that empty host field as the one for http event collector from databases, and as it is a required field, hence the error. The workaround now is to set that field with the host before editing the string and leave it there.

View solution in original post

0 Karma

a_salikov
Path Finder

Hello,

Please, can you help me to solve problem with Splunk DB Connect:
Install Splunk 7.1.3 and DB Connect 3.1.3.
Select data from Oracle DB in SQL Explorer
Set cron = * * * * *, sourcetype = db, index = oracle.
Search index = oracle -> empty result.
Also we tried to downgrade/upgrade core and app versions: Splunk 7.1.3 - > Splunk Db Connect 3.1.3, Splunk 7.1.3 - > Splunk Db Connect 2.4.1, Splunk 6.6.7 - > Splunk Db Connect 3.1.3, Splunk 6.6.7 - > Splunk Db Connect 2.4.1.
We see db, view and table in DbConnect and select data from Oracle in SQL Explorer. Why data from query don’t write into index?

Best regards, Ablay Salikov.

0 Karma

tiagofbmm
Influencer

The bug is clear now: when I edit the url for the jdbc connection string, Splunk has the host field on the left empty (as it should as everything is done on the customized one). The problem is that Splunk is using that empty host field as the one for http event collector from databases, and as it is a required field, hence the error. The workaround now is to set that field with the host before editing the string and leave it there.

View solution in original post

0 Karma

chrisboy68
Contributor

OMG thank you. Been banging my head for days trying to figure out what was going on!!!

Chris

0 Karma

apair
Explorer

Hello

I have the same problem too :
https://answers.splunk.com/answers/661463/why-is-the-splunk-db-connect-not-indexing-data.html

I think it's a bug in version 3.1.3...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!