Deployment Architecture

Why does Splunk DB Connect 1 time out when adding a database input?

tweaktubbie
Communicator

Created multiple inputs on the same database today, but trying to add one resulted in:

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/#/dbx/dbx/dbmon: The read operation timed out',)

Running it in DB Query works, though the query takes 2-3 minutes to complete. So yes, it works, but I can't add it through the web interface because the validation/check obviously times out.

Is there some requirement I'm not aware of or can't find on Answers, or is there some blocking configuration setting? Of course, performance and load is something to keep in mind, but if the query is needed by our business team, it must somehow be there 😉

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

are you on Windows?

Alternatively, we might be able to work something out with a guard's security band, a quarnex battery, and that guy's prosthetic leg...

0 Karma

pcarey
New Member

seeing the same thing here, 'read operation timed out'
only on large 2-3 minute queries in db connect - the queries work perfectly in SQL.

0 Karma

tweaktubbie
Communicator

No, it's on Linux/RedHat. By the way I'm wondering if after adding a dummy query, somehow in a configuration file editing the query is possible. When creating a data source skipping validation is an option, with adding a data input it isn't. Perhaps rewriting it in a report with valid query/stanza is an option, but that would break with the idea of one central place for all db queries from Splunk.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...