Getting Data In

Splunk DB Connect: Why am I getting an error trying to select a column for my dbmon-tail input?

sim_tcr
Communicator

Hello,

I am trying to setup a tailing query using Splunk DB Connect app.

My query is:

select * from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}} 

and it works.

Now i am trying to change it to selected column only as below and while trying to save the database input, I get an error.

select APPLICATION_NM from  table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

Error is:

03-20-2015 06:59:50.313 -0400 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://XXX/XXX-date: Unrecognized or ambiguous rising column name [CREATED_DT] is used. For Oracle database, qualified column name cannot be used, use " ()" instead.\n with query = select APPLICATION_NM from XXXXXXXX WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') \nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n    hand.execute(info)\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 528, in execute\n    if self.requestedAction == ACTION_EDIT:     self.handleEdit(confInfo)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 238, in handleEdit\n    self.handleModification("edit", output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 218, in handleModification\n    id, props = self.process_modification(id, props, type=type, output=output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 95, in process_modification\n    self.validateConfig(stanza, props)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 126, in validateConfig\n    executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\n\n

Can any one assist?

0 Karma

mzorzi
Splunk Employee
Splunk Employee

try with:

{{ WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') AND $rising_column$ > ?}}

0 Karma

sim_tcr
Communicator

it work only if i do select *. Not if I do SELECT somecolumn

0 Karma

sim_tcr
Communicator

one more observation.
i could save select CREATED_DT from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

That is whatever my tailing column i can select that coumn only. Or i have to do select *

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...