Monitoring Splunk

DB Connect 1.1.4: "Error validating dbmonTail for monitor..." trying to create a database input.

dovelsh12223621
Path Finder

When I am running a sql query on database query section in app I am able to get the result.
but when I am trying to create a database input using query I am getting following error:

05-20-2015 11:13:28.130 +0800 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://CONFDB/MONO: DB2 SQL Error: SQLCODE=-104, SQLSTATE=42601, SQLERRMC=WHERE;d=bodycont.contentid;AND, DRIVER=4.16.53 with query = SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid WHERE CONTENTID > ? \n <eai_error><recognized>false</recognized><type><class 'spp.java.bridge.JavaBridgeError'></type><message>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17</message><stacktrace>Traceback (most recent call last):\n  File "/splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n    hand.execute(info)\n  File 
"/splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 526, in execute\n    if self.requestedAction == ACTION_CREATE:   self.handleCreate(confInfo)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 230, in handleCreate\n    self.handleModification("create", output)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 218, in handleModification\n    id, props = self.process_modification(id, props, type=type, output=output)\n  File "/splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 95, in process_modification\n    self.validateConfig(stanza, props)\n  File "/splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 126, in validateConfig\n    executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\n  File "/splunk/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\n</stacktrace></eai_error>\n

My sql like this

"SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid {{WHERE $rising_column$ &gt; ?}}"

And the "CONTENT" regard as Rising Column. Please tell me which the matter ?

0 Karma

zillionlee
Path Finder

try to using the no-renaming column

0 Karma

ppablo
Retired

Hi @dovelsh12223621

Are you using DB Connect 1 or 2? Just want to make sure this post is tagged with the right app so the right folks to help you will get notified

0 Karma

dovelsh12223621
Path Finder

version 1.1.4;
Last night, I tried to solve this problem.And changed the sql:
SELECT cont.contentid,cont.contenttype,cont.title,cont.creator,cont.creationdate,bodycont.body FROM MON02."CONTENT" cont ,MON02."BODYCONTENT" bodycont where cont.contentid=bodycont.contentid {{AND $rising_column$ > ?}},however still has the error .Maybe ,My database query uses two tables,and splunk do not know how to match the query.I am not very familiar with the sql,please help me.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...