Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

[bkoehler4070]

I have DBconnect 3.1.3 running on a 7.0.1 instance with 3 DB Inputs, 2 of them work perfectly but the third one puts out the error below and then fails. Two of the connections are almost identical except they go to different DBs, but one works and one doesn't. I have tried restarting and reconfiguring the input.

2018-04-12 18:48:43.627 +0000 [QuartzScheduler_Worker-29] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unable_to_write_batch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

[dhirendra761]

Hi @andreacorvini ,

I am facing same issue. Can you please send me the link for dbconnect[previous version] as well.
dhirendrasingh.822@gmail.com

[andreacorvini]

ok, shared.

[dhirendra761]

Yes.. I got the link. Thank you so much..

[luis290311]

Hello, I have the same problem. Could you send me the link? luis2903@yahoo.com

[andreacorvini]

Sent.
Please consider I can't share it permanently, this is temporary link from Drive.

[luis290311]

Thanks, it worked! I voted your answer

[bricevaixagon]

May I have it too ?
bricev@aixagon.fr

Thanks !

[andreacorvini]

I sent you the link.

[marziaolla]

Hi Andrea, can you pls send me the link?
marzyolla@gmail.com

[gjanders]

Splunk DB Connect since 3.1.3 is out you cannot download 3.1.2 any more as the app team have removed the visibility on SplunkBase.

Perhaps you can use the current version?

[andreacorvini]

Hello, I have uninstalled DB connect APP and installed the previous version 3.1.2 and all works fine now.

[marcoscala]

Samere here. We had the same issue and using a previous release we had no problem.

[bkoehler4070 · Accepted solution]

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

[dyuran]

I have exactly the same problem, but I do not understand what exactly need to do to fix it! Tell me please more info