Splunk Search

External search command 'dbquery' returned error code 1. Script output = 'There is no such database [stt-dw] available for this user!'

jackiewkc
Path Finder

I have a search which does a basic query to a database using dbquery. I have a user which has a role assigned to it and this role has been given read/write permission to DB Connect and the database. The role also has the capabilites "dbx_capable" and "schedule_rtsearch". However, when running the search, I got the external command error as stated in the title of this question.

The weird thing is that if I add the role "dbx_user" as an inherited role to the role assigned to this user, the search works. The dbx_user role has only the two capabilites "dbx_capable" and "schedule_rtsearch and read/write permission to DB Connect and the database.

I don't understand why the role I created doesn't work since it has the same permissions as the dbx_user role.

Can someone please advise? Thanks.

Regards,
Jackie

Tags (2)

tahakhan
Engager

I encountered a similar error while running the below query:

Select count(Field) from Table

The error was:

External search command 'dbxquery' returned error code 1. Script output = " ERROR "Exception at ""/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py"", line 123 : com.microsoft.sqlserver.jdbc.SQLServerException: No column name was specified for column 1 of 't'.

I changed the query to:

Select count(Field) as count_Field from Table

This resolved the issue. Thought I'd share this.

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...