Splunk DB Input causing ORACLE temp space to fill up

[dlovett]

We have a weird case our DBA and splunk team is trying to resolve;

Our DBAs are seeing 124M of usage increasing roughly 124M a day; We have multiple data inputs running on a schedule; two run a tail every 15minutes with another doing a full read every night at Midnight;

DBAs think the issue is because the JDBC connection is never dropped and would like us to cycle the JDBC connection daily if we can't configure the client to drop the connection after the scheduled job runs;

Anybody else experiencing this issue? If so, any ideas on how to resolve it? is it possible to "cycle" javabridge to reset jdbc connections?

Any help would be appreciated.

[pmdba]

The TEMP tablespace is used for sorts too big to be done in memory, or during index creation, complex join operations, or other types of DDL activities. Specifically, it is only used for ACTIVE queries or DDL commands, and is not something that would fill up over the course of a day or two incrementally. If you are running out of TEMP space because of your Splunk queries, then it is because the SQL is not optimized correctly - it will fill up every time you run it. Resetting your connections won't change this at all. You need to revisit your SQL inputs and see if there is anything you can change: remove any "order by" clauses for starters (do your sorting later in Splunk Search) and see if there is anything else you can do to improve the efficience of your queries.

[ilink_splunk]

Ok, please try turning it off via the app's java.conf. It could be that the connections in the pool are holding on to data longer than they should be. If that doesn't work, please go ahead and open a support case so we can get a diag and troubleshoot further.

[dlovett]

Indeed we are. Thank you 🙂

[ilink_splunk]

Are you using connection pooling?