Splunk Search

External search command 'dbquery' returned error code 1. Script output = 'There is no such database [stt-dw] available for this user!'

jackiewkc
Path Finder

I have a search which does a basic query to a database using dbquery. I have a user which has a role assigned to it and this role has been given read/write permission to DB Connect and the database. The role also has the capabilites "dbx_capable" and "schedule_rtsearch". However, when running the search, I got the external command error as stated in the title of this question.

The weird thing is that if I add the role "dbx_user" as an inherited role to the role assigned to this user, the search works. The dbx_user role has only the two capabilites "dbx_capable" and "schedule_rtsearch and read/write permission to DB Connect and the database.

I don't understand why the role I created doesn't work since it has the same permissions as the dbx_user role.

Can someone please advise? Thanks.

Regards,
Jackie

Tags (2)

tahakhan
Engager

I encountered a similar error while running the below query:

Select count(Field) from Table

The error was:

External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : com.microsoft.sqlserver.jdbc.SQLServerException: No column name was specified for column 1 of 't'.

I changed the query to:

Select count(Field) as count_Field from Table

This resolved the issue. Thought I'd share this.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...