Splunk Search

Splunk DB Connect v1 connects to the database successfully but returns no results when I try any query

logmar5
Explorer

I have installed Splunk DB Connect v1 App and MySQL driver and configured them with my database details. Looks like connection works successfully. If I look at "Database Info", I can select my database from the dropdown and it shows available tables. However, if I try to run any query, it never completes -- just hangs there with "Waiting for search to complete...".

I am looking at dbx.log but it doesn't show any obvious ERRORs. Just perhaps "file null doesn't exist", but not sure what that would mean for me:

2015-06-19 01:51:03.159 dbx1930:DEBUG:DatabaseQueryCommand - infoPath not in command headers... reading it from job sid=null directly...
2015-06-19 01:51:03.160 dbx1930:WARN:DatabaseQueryCommand - SearchResultsInfo file null doesn't exist
2015-06-19 01:51:03.160 dbx1930:DEBUG:DatabaseQueryCommand - srInfo: null
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Fetching connection from factory...
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Fetching connection from pool...
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Activating database connection com.mysql.jdbc.JDBC4Connection@17574841 for database=FIX_DB
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Validating database connection for database=FIX_DB
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Validating database connection...
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Executing test query: SELECT 1
2015-06-19 01:51:03.162 dbx1930:DEBUG:Database - Database validation successful
2015-06-19 01:52:41.335 dbx8318:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx8318
2015-06-19 01:52:41.335 dbx8318:DEBUG:Splunkd - Requesting Splunkd REST service keep-alive...
2015-06-19 01:52:41.335 dbx8318:DEBUG:Splunkd - Performing Splunkd Request: RESTRequest{GET authentication/current-context/context}
2015-06-19 01:52:41.354 dbx8318:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-06-19 01:52:41.354 dbx8318:DEBUG:ExecutionContext - Destroying execution context...
2015-06-19 01:52:41.354 dbx8318:INFO:ExecutionContext - Execution finished in duration=20 ms
2015-06-19 01:57:41.354 dbx5522:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx5522
2015-06-19 01:57:41.355 dbx5522:DEBUG:Splunkd - Requesting Splunkd REST service keep-alive...
2015-06-19 01:57:41.355 dbx5522:DEBUG:Splunkd - Performing Splunkd Request: RESTRequest{GET authentication/current-context/context}
2015-06-19 01:57:41.364 dbx5522:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-06-19 01:57:41.364 dbx5522:DEBUG:ExecutionContext - Destroying execution context...
2015-06-19 01:57:41.364 dbx5522:INFO:ExecutionContext - Execution finished in duration=10 ms

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

that sounds like you're browsing the database successfully but haven't actually built an input to index data with. You're probably very close to success.

0 Karma

hogan24
Path Finder

have you tried running something simple from the search screen like this:

| dbquery dbConnectionName  "select sysdate from dual"

This would return something immediately and validate if the connection to your db is actually in tact.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...