Monitoring Splunk

DB Connect 1.1.4: "Error validating dbmonTail for monitor..." trying to create a database input.

dovelsh12223621
Path Finder

When I am running a sql query on database query section in app I am able to get the result.
but when I am trying to create a database input using query I am getting following error:

05-20-2015 11:13:28.130 +0800 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://CONFDB/MONO: DB2 SQL Error: SQLCODE=-104, SQLSTATE=42601, SQLERRMC=WHERE;d=bodycont.contentid;AND, DRIVER=4.16.53 with query = SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid WHERE CONTENTID > ? \n <eai_error><recognized>false</recognized><type><class 'spp.java.bridge.JavaBridgeError'></type><message>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17</message><stacktrace>Traceback (most recent call last):\n  File "/splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n    hand.execute(info)\n  File 
"/splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 526, in execute\n    if self.requestedAction == ACTION_CREATE:   self.handleCreate(confInfo)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 230, in handleCreate\n    self.handleModification("create", output)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 218, in handleModification\n    id, props = self.process_modification(id, props, type=type, output=output)\n  File "/splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 95, in process_modification\n    self.validateConfig(stanza, props)\n  File "/splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 126, in validateConfig\n    executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\n</stacktrace></eai_error>\n

My sql like this

"SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid {{WHERE $rising_column$ &gt; ?}}"

And the "CONTENT" regard as Rising Column. Please tell me which the matter ?

0 Karma

zillionlee
Path Finder

try to using the no-renaming column

0 Karma

ppablo
Retired

Hi @dovelsh12223621

Are you using DB Connect 1 or 2? Just want to make sure this post is tagged with the right app so the right folks to help you will get notified

0 Karma

dovelsh12223621
Path Finder

version 1.1.4;
Last night, I tried to solve this problem.And changed the sql:
SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid {{AND $rising_column$ > ?}},however still has the error .Maybe ,My database query uses two tables,and splunk do not know how to match the query.I am not very familiar with the sql,please help me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...