Archive

Splunk DB Input causing ORACLE temp space to fill up

dlovett
Path Finder

We have a weird case our DBA and splunk team is trying to resolve;

Our DBAs are seeing 124M of usage increasing roughly 124M a day; We have multiple data inputs running on a schedule; two run a tail every 15minutes with another doing a full read every night at Midnight;

DBAs think the issue is because the JDBC connection is never dropped and would like us to cycle the JDBC connection daily if we can't configure the client to drop the connection after the scheduled job runs;

Anybody else experiencing this issue? If so, any ideas on how to resolve it? is it possible to "cycle" javabridge to reset jdbc connections?

Any help would be appreciated.

Tags (1)

pmdba
Builder

The TEMP tablespace is used for sorts too big to be done in memory, or during index creation, complex join operations, or other types of DDL activities. Specifically, it is only used for ACTIVE queries or DDL commands, and is not something that would fill up over the course of a day or two incrementally. If you are running out of TEMP space because of your Splunk queries, then it is because the SQL is not optimized correctly - it will fill up every time you run it. Resetting your connections won't change this at all. You need to revisit your SQL inputs and see if there is anything you can change: remove any "order by" clauses for starters (do your sorting later in Splunk Search) and see if there is anything else you can do to improve the efficience of your queries.

0 Karma

ilink_splunk
Splunk Employee
Splunk Employee

Ok, please try turning it off via the app's java.conf. It could be that the connections in the pool are holding on to data longer than they should be. If that doesn't work, please go ahead and open a support case so we can get a diag and troubleshoot further.

0 Karma

dlovett
Path Finder

Indeed we are. Thank you 🙂

0 Karma

ilink_splunk
Splunk Employee
Splunk Employee

Are you using connection pooling?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!