All Apps and Add-ons
Highlighted

Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

I have DBconnect 3.1.3 running on a 7.0.1 instance with 3 DB Inputs, 2 of them work perfectly but the third one puts out the error below and then fails. Two of the connections are almost identical except they go to different DBs, but one works and one doesn't. I have tried restarting and reconfiguring the input.

2018-04-12 18:48:43.627 +0000 [QuartzSchedulerWorker-29] ERROR c.s.d.s.task.listeners.RecordWriterMetricsListener - action=unabletowritebatch
java.io.IOException: HTTP Error 400: Bad Request
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEventBatch(HttpEventCollector.java:112)
at com.splunk.dbx.server.dbinput.recordwriter.HttpEventCollector.uploadEvents(HttpEventCollector.java:89)
at com.splunk.dbx.server.dbinput.recordwriter.HecEventWriter.writeRecords(HecEventWriter.java:36)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

Found the problem, the HEC fails to write when a single event has 800000+ characters. Had 1 log message that was ~800x the size of a normal log message and that was causing the failure, when that message is skipped (by changing the rising column) everything goes back to working as intended.

View solution in original post

Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

I have exactly the same problem, but I do not understand what exactly need to do to fix it! Tell me please more info

Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Path Finder

Hello, I have uninstalled DB connect APP and installed the previous version 3.1.2 and all works fine now.

Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Builder

Samere here. We had the same issue and using a previous release we had no problem.

0 Karma
Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

SplunkTrust
SplunkTrust

Had this exact same symptom but a very different cause in DB Connect 3.1.2

After debugging it was found that the host field on the input was empty (which is allowed as it defaults to the connection hostname), however since the connection was set to use the JDBC URL the hostname was blank there as well.

This appears to be only possible if while creating the connection the edit JDBC URL button is pressed and no hostname is left in the box.

I have case open to ensure the application gets updated to prevent this scenario but it was very difficult to find the issue, the root cause was DB Connect attempting to send a hostname of "null" via HTTP Event Collector which also has minimal logging available

Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

Hi.
Tell me where can I download the version DB Connect 3.1.2?
I can not download it on the site (((
Could you send it to my e-mail dyuran@list.ru?

0 Karma
Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

SplunkTrust
SplunkTrust

Splunk DB Connect since 3.1.3 is out you cannot download 3.1.2 any more as the app team have removed the visibility on SplunkBase.

Perhaps you can use the current version?

0 Karma
Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Path Finder

I sent you an email with a link to download it.
Ciao
Andrea

0 Karma
Highlighted

Re: Why are DBconnect 3 inputs unable to write records and giving an http 400: bad request error?

Explorer

Thank you, this version works for me.

0 Karma