Splunk Search

How to cancel |dbxquery sql query?

mlevsh
Builder

Hi,

We are using Splunk DB Connect on search heads to run "|dbxquery" command with SQL queries to Snowflake DB.

Sometimes user , who is  running one of the queries,  realizes,  that a query  would return a  lot of data and cancels  the search by clicking on "Stop" on Splunk GUI, but on Snowflake DB the query is still being executed.

Anybody knows how to Cancel the search initiated via Splunk GUI with |dbxquery command?

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @mlevsh 

There was no mention of documents about cancel the query on DB. Splunk DBConnect uses JDBC driver which has cancel operation however it should be supported by both DBMS & driver that you are using it inside DBConnect.  Try timeout= option in dbxquery command to avoid it running for long time.

Refer- java - Stop or terminate long running query in JDBC - Stack Overflow

-----------------------------

An upvote would be appreciated if it helps!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...