Can't generate Tableau extract - error "internal error starextracttuplesource has wrong number of bindings for number of input columns"

[jjohns86]

I'm having trouble using Tableau to extract data for a Tableau report. I can connect to the saved-search fine by connecting live, but when I try to generate an extract (for Tableau report performance reasons) it gives the error

"internal error starextracttuplesource has wrong number of bindings for number of input columns".

When I look at the fields available in the Tableau DataSource page, it shows the 3 explicit fields I defined in my report search, but also an additional field not present in the search ([MySplunkSavedReport].[_pre_msg]). This is odd for me, as I am able to generate an extract from another saved report, which also includes similar fields (logonuser (text), usertype (text), and _time).

Is this related to the known issue identified as DVPL-2957? Any recommendations as to how I can resolve? A somwhat cleaned-up search is below if it is helpful or needed to give context (I can provide more details/clarification if needed).

Thanks in advance to any splunk gurus who can help!

Jeff

host=server* source="WinEventLog:Microsoft-Windows-TerminalServices-SessionBroker/Operational" 801 | rex field=Message "user DOMAINName\\\(?<logonUser>.\w+)" |eval ADAccount=ltrim(logonUser,"DOMAINName\\") | ldapfilter domain=DOMAINName search="(sAMAccountName=$ADAccount$)" attrs="memberOf" | eval userType=case((mvfind(memberOf,"CN\=GRP_Name1") >= 0 ), "Group1", (mvfind(memberOf,"CN\=GRP_Name2") >= 0 ), "Group2", (mvfind(memberOf,"CN\=GRP_Name3") >= 0 ), "Group3") | fields logonUser,userType,_time

[jjohns86 · Accepted solution]

Well, not sure what fixed it, but I am no longer getting this error. After updating the Splunk ODBC client on my desktop I restarted my computer, and started fresh with a new Tableau report connecting to the Splunk saved report, and am no longer getting the "wrong number of bindings for number of input columns" error. I wish I could concretely point to what I may have done to resolve....most likely guessing the client update, but can't confirm for sure.

[jjohns86]

Edit: Should have added earlier....
We are using Splunk 6.2.2, and I am using Tableau Report Creator 9.0.2 (64-bit) on Windows with Splunk ODBC Connector 1.01

[jjohns86]

Updated Splunk connector to use ODBC 2.0 64-bit version with same results.