Deployment Architecture

Why does Splunk DB Connect 1 time out when adding a database input?

tweaktubbie
Communicator

Created multiple inputs on the same database today, but trying to add one resulted in:

Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/#/dbx/dbx/dbmon: The read operation timed out',)

Running it in DB Query works, though the query takes 2-3 minutes to complete. So yes, it works, but I can't add it through the web interface because the validation/check obviously times out.

Is there some requirement I'm not aware of or can't find on Answers, or is there some blocking configuration setting? Of course, performance and load is something to keep in mind, but if the query is needed by our business team, it must somehow be there 😉

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

are you on Windows?

Alternatively, we might be able to work something out with a guard's security band, a quarnex battery, and that guy's prosthetic leg...

0 Karma

pcarey
New Member

seeing the same thing here, 'read operation timed out'
only on large 2-3 minute queries in db connect - the queries work perfectly in SQL.

0 Karma

tweaktubbie
Communicator

No, it's on Linux/RedHat. By the way I'm wondering if after adding a dummy query, somehow in a configuration file editing the query is possible. When creating a data source skipping validation is an option, with adding a data input it isn't. Perhaps rewriting it in a report with valid query/stanza is an option, but that would break with the idea of one central place for all db queries from Splunk.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!