All Apps and Add-ons

Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

bkoehler4070
Explorer

I have DBconnect 3.1.3 running on a 7.0.1 instance with 3 DB Inputs, 2 of them work perfectly but the third one puts out the error below and then fails. Two of the connections are almost identical except they go to different DBs, but one works and one doesn't. I have tried restarting and reconfiguring the input.

2018-04-12 18:48:43.627 +0000 [QuartzScheduler_Worker-29] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

1 Solution

bkoehler4070
Explorer

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

View solution in original post

dhirendra761
Contributor

Hi @andreacorvini ,

I am facing same issue. Can you please send me the link for dbconnect[previous version] as well.
dhirendrasingh.822@gmail.com

0 Karma

andreacorvini
Path Finder

ok, shared.

0 Karma

dhirendra761
Contributor

Yes.. I got the link. Thank you so much..

0 Karma

luis290311
Explorer

Hello, I have the same problem. Could you send me the link? luis2903@yahoo.com

0 Karma

andreacorvini
Path Finder

Sent.
Please consider I can't share it permanently, this is temporary link from Drive.

0 Karma

luis290311
Explorer

Thanks, it worked! I voted your answer

bricevaixagon
Explorer

May I have it too ?
bricev@aixagon.fr

Thanks !

0 Karma

andreacorvini
Path Finder

I sent you the link.

0 Karma

marziaolla
Explorer

Hi Andrea, can you pls send me the link?
marzyolla@gmail.com

0 Karma

gjanders
SplunkTrust
SplunkTrust

Splunk DB Connect since 3.1.3 is out you cannot download 3.1.2 any more as the app team have removed the visibility on SplunkBase.

Perhaps you can use the current version?

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

andreacorvini
Path Finder

Hello, I have uninstalled DB connect APP and installed the previous version 3.1.2 and all works fine now.

marcoscala
Builder

Samere here. We had the same issue and using a previous release we had no problem.

0 Karma

bkoehler4070
Explorer

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

View solution in original post

dyuran
Explorer

I have exactly the same problem, but I do not understand what exactly need to do to fix it! Tell me please more info

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!