My Splunk Enterprise Version is 7.1.0 and DBX(Splnuk DB Connect) version is 3.1.3. After I add an DB Input i can't see any data in index
When I check Internal index, i found the error below :
2018-08-07 14:15:23.908 +0800 [QuartzScheduler_Worker-19] ERROR org.easybatch.core.job.BatchJob - Unable to write records
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
2018-08-07 14:15:23.908 +0800 [QuartzScheduler_Worker-19] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Is there anyone who knows how to solve this , many thanks!
Hi,
I'm facing same issue, what is the solution for this issue?
Regards,
Satheesh
Hi ,
Uninstall the Splunk dbConnect 3.1.3
and install dbconnect 3.1.2
below is the reference of same issue
https://answers.splunk.com/answers/640570/why-are-dbconnect-3-inputs-unable-to-write-records.html
Thanks.
Hi @Liuzhengchen .. Did you check with above solution.
I have resolved mine
ref:
https://answers.splunk.com/answers/710632/splunk-dbconnect-is-not-creating-sourcetype.html
Thanks
Hi,
I have the same problem. Did you find a solution ?
ManyThanks
Jeff