Splunk DB Connect 1: Why am I getting error "command="dbquery", A database error occurred: Invalid Fetch Size"?

[DanielFordWA]

Hi,

I keep getting the following error in DB connect 1. I have setup the External Database and can use it for lookups in search, but any large manual queries or Database inputs do not work.

Error

command="dbquery", A database error occurred: Invalid Fetch Size

I am running Splunk on the below.

jre6
WindowsServer2008R2

How can I fix this with my current setup?

Will switching to jre8 and DB Connect 2 sort this out?

Ticking the 'limit to 1000 results' results in the query working every time, but this is not really a resolution to the issue.

[jcoates_splunk]

dbquery (and dbxquery in DB Connect 2) are designed for interactive browsing of small data sets. The assumption has been that you'd index the data if you need to do big data manipulation tasks.

[DanielFordWA]

Thanks for the reply.

I need to enrich around 10,000 clients at a time for ad hoc queries. The entire DB contains around 170,000 clients with 25 columns of info.

"The assumption has been that you'd index the data if you need to do big data manipulation tasks"

How do you advise I do this?

I had mistakenly assumed that with DBconnect I can pull the entire DB and index it, then pull the changes daily. I was then planning to run searches against the index.

Hope you can help.

[jcoates_splunk]

that is exactly what I'm suggesting.
v1: http://docs.splunk.com/Documentation/DBX/1.2.0/DeployDBX/Configuredatabasemonitoring#Configure_input...
v2: http://docs.splunk.com/Documentation/DBX/2.0.3/DeployDBX/Createandmanagedatabaseinputs