All Apps and Add-ons

Splunk DBConnect Can't write data

tiagofbmm
Influencer

Hello All

DBConnect 3.1.3 is avoiding me to index data from Databases, although the input configuration actually works fine, I can see the query results.

But when the scheduled input runs on a regular basis, I get this error and data is never written to the index.

[QuartzScheduler_Worker-16] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
    at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
    at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
    at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
    at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
    at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Any ideas of workaround besides downgrading (by the way, the official downgrade would have to be to 2.4.1, not acceptable)

Any help?

Thank you in advance

0 Karma
1 Solution

tiagofbmm
Influencer

The bug is clear now: when I edit the url for the jdbc connection string, Splunk has the host field on the left empty (as it should as everything is done on the customized one). The problem is that Splunk is using that empty host field as the one for http event collector from databases, and as it is a required field, hence the error. The workaround now is to set that field with the host before editing the string and leave it there.

View solution in original post

0 Karma

a_salikov
Path Finder

Hello,

Please, can you help me to solve problem with Splunk DB Connect:
Install Splunk 7.1.3 and DB Connect 3.1.3.
Select data from Oracle DB in SQL Explorer
Set cron = * * * * *, sourcetype = db, index = oracle.
Search index = oracle -> empty result.
Also we tried to downgrade/upgrade core and app versions: Splunk 7.1.3 - > Splunk Db Connect 3.1.3, Splunk 7.1.3 - > Splunk Db Connect 2.4.1, Splunk 6.6.7 - > Splunk Db Connect 3.1.3, Splunk 6.6.7 - > Splunk Db Connect 2.4.1.
We see db, view and table in DbConnect and select data from Oracle in SQL Explorer. Why data from query don’t write into index?

Best regards, Ablay Salikov.

0 Karma

tiagofbmm
Influencer

The bug is clear now: when I edit the url for the jdbc connection string, Splunk has the host field on the left empty (as it should as everything is done on the customized one). The problem is that Splunk is using that empty host field as the one for http event collector from databases, and as it is a required field, hence the error. The workaround now is to set that field with the host before editing the string and leave it there.

0 Karma

chrisboy68
Contributor

OMG thank you. Been banging my head for days trying to figure out what was going on!!!

Chris

0 Karma

apair
Explorer

Hello

I have the same problem too :
https://answers.splunk.com/answers/661463/why-is-the-splunk-db-connect-not-indexing-data.html

I think it's a bug in version 3.1.3...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...