ExecProcessor Error

[gitau_gm]

Good day team. Getting this error. That is date corresponds to the last day the host was seen.

05-28-2025 11:51:03.469 +0000 ERROR ExecProcessor [9317 ExecProcessor] - message from "/opt/splunk/etc/apps/splunk_app_db_connect/bin/server.sh" com.splunk.modularinput.Event.writeTo(Event.java:65)\\com.splunk.modularinput.EventWriter.writeEvent(EventWriter.java:137)\\com.splunk.DefaultServerStart.streamEvents(DefaultServerStart.java:66)\\com.splunk.modularinput.Script.run(Script.java:66)\\com.splunk.modularinput.Script.run(Script.java:44)\\com.splunk.dbx.server.bootstrap.TaskServerStart.main(TaskServerStart.java:36)\\

[gitau_gm]

@livehybrid , drilling further, saw this message

message from "/opt/splunk/bin/python3.9 /opt/splunk/etc/apps/cloud_administration/bin/aging_out.py" Cannot extract stack id from host, reason=File at /opt/splunk/etc/system/local/data_archive.conf does not exist.

[livehybrid]

Hi @gitau_gm 

This ExecProcessor error indicates that the Splunk DB Connect modular input script (server.sh) failed during execution. The Java stack trace suggests an issue occurred while the DB Connect app was processing or writing events, likely after fetching data from the database.

To troubleshoot this:

1. Check DB Connect Internal Logs: Look for more detailed error messages within the DB Connect app's internal logs. Search index=_internal sourcetype="dbx*"
2. Verify Database Connection: Ensure the database connection configured in DB Connect is still valid and accessible from the Splunk server. Check credentials, host, port, and network connectivity.
3. Review the Input Query: Examine the SQL query used by the failing input. Test the query directly against the database to ensure it runs without errors and returns data as expected. Large result sets or specific data types might sometimes cause issues.
4. Check Splunk Resources: Monitor the Splunk server's resource usage (CPU, memory) when the input is scheduled to run. Resource exhaustion can sometimes lead to process failures.
5. Restart DB Connect: Try restarting the DB Connect app from the Splunk UI or by restarting Splunk.

The detailed error message in the DB Connect internal logs will provide more specific clues about the root cause, such as a database error, a data processing issue, or a configuration problem.

Are you getting _internal logs from the HF running the DB Connect app? If not then restarting this would be the first thing to try, and then check the splunk logs directly on the HF if still not sending data to Splunk.

For more info check out https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gitau_gm]

*That date corresponds to the last day the host was seen.