DBX TailDatabaseMonitor Error

[domgkc]

I am receiving an error in the DB Connect application.
Was having issues with the timestamping and event breaking.
The database is Oracle, the DB Info section shows the timestamp field as a "DATE" object but only extracts the epoch value of the Date and not the full timestamp.

Change the table monitoring to use the extract time by omitting the timestamp field and now the extract fails with the following

2013-05-22 09:26:13.735 dbx3559:ERROR:TailDatabaseMonitor - Error while executing database monitor: java.lang.IllegalArgumentException: Illegal group reference
java.lang.IllegalArgumentException: Illegal group reference
at java.util.regex.Matcher.appendReplacement(Matcher.java:713)
at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.buildSqlQuery(TailDatabaseMonitor.java:59)
at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.performMonitoring(TailDatabaseMonitor.java:92)
at com.splunk.dbx.monitor.DatabaseMonitorExecutor.executeMonitor(DatabaseMonitorExecutor.java:126)
at com.splunk.dbx.monitor.DatabaseMonitorExecutor.call(DatabaseMonitorExecutor.java:102)
at com.splunk.dbx.monitor.DatabaseMonitorExecutor.call(DatabaseMonitorExecutor.java:37)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)

[ziegfried · Accepted solution]

You can either use the column name directly or use literal $rising_column$ that is replaced with the value you entered in the rising column field for the input. So either of the following 2 queries should work:

SELECT TRANSACTION_ID, TRANSACTION_DATE, OTHER, FIELDS FROM MYSCHEMA.MY_TABLE  {{WHERE TRANSACTION_ID > ?}}

or

SELECT TRANSACTION_ID, TRANSACTION_DATE, OTHER, FIELDS FROM MYSCHEMA.MY_TABLE  {{WHERE $rising_column$ > ?}}

[domgkc]

SELECT TRANSACTION_ID, TRANSACTION_DATE, OTHER, FIELDS FROM MYSCHEMA.MY_TABLE {{WHERE $TRANSACTION_ID$ > ?}}

I am doing this as the DB owners would prefer I didn't grab the entire row. I am not doing anything clever with the query just grabing a subset of the fields from a single table.

I am not doing any timestamping as the date field for some reason comes out as date only and no timestamp.

The DB is Oracle 10.2. and the JVM is Sun 1.6.

[ziegfried]

Could you please provide the custom SQL query you are using?