db_connect: Why an error when trying to query basic select?

[jotaforense]

Hello,
I have an odd problem with db_connect :
My connection is ok

I can see the database and the tables but when i try to query (basic select) i have an error

Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

My query is

| dbxquery query="select * from aps.notifications " connection="PE"

even select 1 from dual doesn't work

Database : Oracle
User : root privileges
Splunk 7.0.0
DB connect 3.1.4
App Build 43

[jotaforense]

@rapmancz , I believe the problem resolved when I updated the db_connect driver.

[richgalloway]

Verify you have the right driver installed for your target DB.
Check the search log (via job inspector) to see what details, if any, are reported about the error.

[jotaforense]

can i send the log? 

[richgalloway]

You can post logs fragments here, but don't submit the entire search log as it is too large and probably contains private information. Just post the relevant entries.

[jotaforense]

look at the error log
the server name has been replaced.

[]

07-03-2020 13:10:28.195 ERROR ChunkedExternProcessor - stderr: 13:10:28.194 111194@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
.....

07-03-2020 13:10:28.341 ERROR ChunkedExternProcessor - stderr: 13:10:28.337 111194@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:29.073 ERROR ChunkedExternProcessor - stderr: 13:10:29.073 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:29.074 ERROR ChunkedExternProcessor - stderr: 13:10:29.074 111194@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:29.087 ERROR ChunkedExternProcessor - stderr: 13:10:29.087 111194@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 79 ms to rescan all jdbc drivers
07-03-2020 13:10:29.141 ERROR ChunkedExternProcessor - stderr: 13:10:29.138 111281@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed
07-03-2020 13:10:29.152 ERROR ChunkedExternProcessor - stderr: 13:10:29.149 111194@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60

.....

07-03-2020 13:10:29.245 ERROR ChunkedExternProcessor - stderr: 13:10:29.244 111281@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US

.....

07-03-2020 13:10:29.775 ERROR ChunkedExternProcessor - stderr: 13:10:29.774 111315@vukoo-br [main] INFO c.splunk.dbx.utils.TrustManagerUtil - action=load_key_manager_succeed

.....

07-03-2020 13:10:29.877 ERROR ChunkedExternProcessor - stderr: 13:10:29.876 111315@vukoo-br [main] WARN com.splunk.dbx.message.MessageEnum - action=initialize_resource_bundle_files error=Can't find bundle for base name Messages, locale en_US
07-03-2020 13:10:30.310 ERROR ChunkedExternProcessor - stderr: 13:10:30.310 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc42.jar]
07-03-2020 13:10:30.311 ERROR ChunkedExternProcessor - stderr: 13:10:30.311 111315@vukoo-br [main] WARN c.s.d.s.driver.DriverServiceImpl - action=load_drivers Can not load any driver from files [/opt/splunk/etc/apps/splunk_app_db_connect/drivers/sqljdbc41.jar]
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=register_driver driver=oracle.jdbc.OracleDriver 11.2 succeeded
07-03-2020 13:10:30.325 ERROR ChunkedExternProcessor - stderr: 13:10:30.320 111315@vukoo-br [main] INFO c.s.d.s.driver.DriverServiceImpl - action=load_drivers spent 63 ms to rescan all jdbc drivers
07-03-2020 13:10:30.390 ERROR ChunkedExternProcessor - stderr: 13:10:30.389 111315@vukoo-br [main] INFO c.s.dbx.connector.ConnectorFactory - action=collect_connection_pool_metrics interval_in_seconds=60
07-03-2020 13:10:30.641 ERROR ChunkedExternProcessor - stderr: 13:10:30.641 111315@vukoo-br [main] WARN c.s.d.c.c.impl.JdbcConnectorImpl - fetch size value reached the allowed max value, MAX_FETCH_SIZE_ALLOWED=10000
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: 13:10:30.800 111315@vukoo-br [main] ERROR c.s.d.c.c.impl.JdbcConnectorImpl - action=fail_to_close_connection error=Protocol violation
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newArray(Native Method)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at java.lang.reflect.Array.newInstance(Array.java:75)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.BufferCache.get(BufferCache.java:212)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.PhysicalConnection.getCharBuffer(PhysicalConnection.java:7698)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.prepareAccessors(OracleStatement.java:1013)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receiveCommon(T4CTTIdcb.java:277)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIdcb.receive(T4CTTIdcb.java:146)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.readDCB(T4C8Oall.java:916)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:421)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:227)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:531)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:208)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:886)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:1175)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1288)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3613)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3657)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeQuery(OraclePreparedStatementWrapper.java:1495)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.JdbcConnectorImpl.executeQuery(JdbcConnectorImpl.java:291)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.connector.connector.impl.OracleConnectorImpl.executeQuery(OracleConnectorImpl.java:41)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.generate(DbxQueryCommand.java:308)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.process(GeneratingCommand.java:183)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.ChunkedCommandDriver.execute(ChunkedCommandDriver.java:102)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.AbstractSearchCommand.run(AbstractSearchCommand.java:50)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.search.command.GeneratingCommand.run(GeneratingCommand.java:15)
07-03-2020 13:10:30.801 ERROR ChunkedExternProcessor - stderr: at com.splunk.dbx.command.DbxQueryCommand.main(DbxQueryCommand.java:234)
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - EOF while attempting to read transport header
07-03-2020 13:10:30.828 ERROR ChunkedExternProcessor - Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

.....

07-03-2020 13:10:30.835 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1.

[richgalloway]

Have you verified you have the correct driver for your DB?
See if this helps: https://arjunkrajan.wordpress.com/tag/splunk/

[jotaforense]

I'll check!

[rapmancz]

@jotaforense How did you solve it? I have exactly the same issue (with MySQL database), select=1 also does not work, Splunk 8.1 on Windows server 64bit, existing database inputs are working fine but I am not able to add any new one because of this failure....