splunk db connect index1 out of range error

[ndcl]

Hi,

we useing db connect to read data from a MS SQL CMDB. We where able to create a valid connction and Identity. If we create a Batch Input they will be no errors but if we change to rising then the MS jdbc driver thows this error:

com.microsoft.sqlserver.jdbc.sqlserverexception the index 1 is out of range.

my first though was to give the filed "checkpoint value" a value but it change nothing...

any idears?

Thanks!!!

[davidjohnbecket · Accepted solution]

i had the same issue - see https://answers.splunk.com/answers/569404/unable-to-configure-an-input-on-splunk-db-connect.html,i got the same issue and ended up using the '?' in the SQL query and this worked.

e.g.

SELECT *
FROM "SQLAuditLogs"."dbo"."Audit_Infra"
WHERE event_time > ?
ORDER BY event_time ASC

[rogue_carrot]

Question mark did not work for me. 0_o

[jeffcosplunk]

The question mark did work for me - thanks!

[markhvesta]

Did you enter the actual value for the checkpoint value in the query? I did this and was getting the same error until I changed it to a question mark

[kparmar01]

Thanks, this helped 🙂

[Ohiotech]

After the 5.10 schema upgrade, having two databases to modify my table query pointers, and getting the index 1 error, I figured out that you have to unlock the pointer and set it to zero because you are starting the index from scratch and the pointer (AutoID) had no place to start. This fixed my error and allowed me to continue to the last step and save the query. I did have to take the line pull up to 100,000 lines to catch up in a hurry.