All Apps and Add-ons

Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

I have DBconnect 3.1.3 running on a 7.0.1 instance with 3 DB Inputs, 2 of them work perfectly but the third one puts out the error below and then fails. Two of the connections are almost identical except they go to different DBs, but one works and one doesn't. I have tried restarting and reconfiguring the input.

2018-04-12 18:48:43.627 +0000 [QuartzScheduler_Worker-29] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

1 Solution

Explorer

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

View solution in original post

Contributor

Hi @andreacorvini ,

I am facing same issue. Can you please send me the link for dbconnect[previous version] as well.
dhirendrasingh.822@gmail.com

0 Karma

Path Finder

ok, shared.

0 Karma

Contributor

Yes.. I got the link. Thank you so much..

0 Karma

Explorer

Hello, I have the same problem. Could you send me the link? luis2903@yahoo.com

0 Karma

Path Finder

Sent.
Please consider I can't share it permanently, this is temporary link from Drive.

0 Karma

Explorer

Thanks, it worked! I voted your answer

Explorer

May I have it too ?
bricev@aixagon.fr

Thanks !

0 Karma

Path Finder

I sent you the link.

0 Karma

Explorer

Hi Andrea, can you pls send me the link?
marzyolla@gmail.com

0 Karma

SplunkTrust
SplunkTrust

Splunk DB Connect since 3.1.3 is out you cannot download 3.1.2 any more as the app team have removed the visibility on SplunkBase.

Perhaps you can use the current version?

0 Karma

Path Finder

Hello, I have uninstalled DB connect APP and installed the previous version 3.1.2 and all works fine now.

Builder

Samere here. We had the same issue and using a previous release we had no problem.

0 Karma

Explorer

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

View solution in original post

Explorer

I have exactly the same problem, but I do not understand what exactly need to do to fix it! Tell me please more info