Splunk Search

External search command 'dbquery' returned error code 1. Script output = 'There is no such database [stt-dw] available for this user!'

jackiewkc
Path Finder

I have a search which does a basic query to a database using dbquery. I have a user which has a role assigned to it and this role has been given read/write permission to DB Connect and the database. The role also has the capabilites "dbx_capable" and "schedule_rtsearch". However, when running the search, I got the external command error as stated in the title of this question.

The weird thing is that if I add the role "dbx_user" as an inherited role to the role assigned to this user, the search works. The dbx_user role has only the two capabilites "dbx_capable" and "schedule_rtsearch and read/write permission to DB Connect and the database.

I don't understand why the role I created doesn't work since it has the same permissions as the dbx_user role.

Can someone please advise? Thanks.

Regards,
Jackie

Tags (2)

tahakhan
Engager

I encountered a similar error while running the below query:

Select count(Field) from Table

The error was:

External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : com.microsoft.sqlserver.jdbc.SQLServerException: No column name was specified for column 1 of 't'.

I changed the query to:

Select count(Field) as count_Field from Table

This resolved the issue. Thought I'd share this.

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...