Splunk Search

Database Query汉字问题

dengjin
New Member

在Database Query中,搜索语句如果包含汉字,则会报错:Error in 'script': Getinfo probe failed for external search command 'dbquery'
搜索语句如下:
select substr(va.CZ,1,10) as time,count(*) as num,count(distinct yh) from LOG va
where va.CZ >= '2013-07-01' and va.CZ <= '2013-07-19' and va.mc = '平台'
group by substr(va.CZ,1,10)
order by substr(va.CZ,1,10) asc

0 Karma

shizl
Engager

When Chinese post to splunkweb, it use GB2312 encode. it should decode to unicode then encode utf-8

please modify the sendEncoded function in bridge.py

def sendEncoded(self, type, data):
    if isinstance(data, unicode):
        enc = unicode(data).encode('utf-8')
    else:  
        enc = data.decode('gb2312').encode('utf-8')
    header = struct.pack('>ci', type, len(enc))
    self.socket.send(header)
    self.socket.send(enc)

This method is not fit for other language encode.

0 Karma

lajiao
New Member

I met the same problem
Splunk 5.0.7 for win2003 sp2 X86(jdk1.7.0_25),DB Connect 1.1.3,oracle

select * from def_ia_user where sta_condition='20131027' and NAME='陈飞'

Getinfo probe failed for external search command 'dbquery'

0 Karma

linu1988
Champion

where are you running this query?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...