When Using DBX got Error : ERROR org.easybatch.core.job.BatchJob - Unable to write records

[Liuzhengchen]

My Splunk Enterprise Version is 7.1.0 and DBX(Splnuk DB Connect) version is 3.1.3. After I add an DB Input i can't see any data in index

When I check Internal index, i found the error below :

2018-08-07 14:15:23.908 +0800 [QuartzScheduler_Worker-19] ERROR org.easybatch.core.job.BatchJob - Unable to write records
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

2018-08-07 14:15:23.908 +0800 [QuartzScheduler_Worker-19] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Is there anyone who knows how to solve this , many thanks!

[Satheesh_red]

Hi,

I'm facing same issue, what is the solution for this issue?

Regards,

Satheesh

[dhirendra761]

Hi ,

Uninstall the Splunk dbConnect 3.1.3 and install dbconnect 3.1.2

below is the reference of same issue
https://answers.splunk.com/answers/640570/why-are-dbconnect-3-inputs-unable-to-write-records.html
Thanks.

[dhirendra761]

Hi @Liuzhengchen .. Did you check with above solution.
I have resolved mine
ref:
https://answers.splunk.com/answers/710632/splunk-dbconnect-is-not-creating-sourcetype.html

Thanks

[jeffdem]

Hi,
I have the same problem. Did you find a solution ?
ManyThanks
Jeff