Why is the Splunk DB Connect app suddenly not pulling logs into our index?

[madan27]

Hi Splunkers,

Suddenly I am not getting logs in to index fetching from database via Splunk DB Connect App.

The error logs which I received from dbx_debug sourcetype as below.

dbx3895:ERROR:ResultSetOutputPayload - The timestamp column "timesstamp" doesn't exist!

dbx2125:ERROR:TailDatabaseMonitor - Error while executing database monitor: com.splunk.dbx.DbxException: Error getting database connection: ORA-28001: the password has expired

dbx7905:ERROR:TailDatabaseMonitor - Error while executing database monitor: com.ibm.db2.jcc.am.SqlSyntaxErrorException: DB2 SQL Error: SQLCODE=-206, SQLSTATE=42703, SQLERRMC=UPDATED_TIME, DRIVER=4.14.111
com.ibm.db2.jcc.am.SqlSyntaxErrorException: DB2 SQL Error: SQLCODE=-206, SQLSTATE=42703, SQLERRMC=UPDATED_TIME, DRIVER=4.14.111

Error while executing database monitor: java.sql.SQLSyntaxErrorException: ORA-00907: missing right parenthesis
java.sql.SQLSyntaxErrorException: ORA-00907: missing right parenthesis 

Please guide me to solve this issue.
Thanks

[richgalloway]

Your logs have a few different errors, but this one seems most relevant:

dbx2125:ERROR:TailDatabaseMonitor - Error while executing database monitor: com.splunk.dbx.DbxException: Error getting database connection: ORA-28001: the password has expired

An expired password would certainly explain a sudden failure to extract data. Update your DB Connect settings for the database to have the new password and try again.

[ppablo]

Hi @madan27

Which version of Splunk DB Connect are you using? 1 or 2?

[madan27]

It is working fine now as admin enabled some options.