Splunk DB Connect Error - NullValuePointerException

[ShaneNewman]

I am getting this error on some data I am trying to push into a Teradata database:

command="dboutput", Unexpected error while performing dboutput: java.lang.NullPointerException

This is a little confusing, mostly because when I do a search of the data without the | dboutput command there are not any NULL fields.

This is the Log

2014-04-04 17:42:02.188 dbx8261:ERROR:SQLInsertHandler - Error occurred while performing database output: java.lang.NullPointerException
java.lang.NullPointerException
2014-04-04 17:42:02.188 dbx8261:INFO:Database - Rolling back changes...
2014-04-04 17:42:02.434 dbx8261:ERROR:DatabaseOutputCommand - Error while executing command: Unexpected error while performing dboutput: java.lang.NullPointerException
2014-04-04 17:42:02.434 dbx8261:INFO:BridgeSession - Execution finished in duration=3640 ms with status=0
2014-04-04 17:42:02.435 dbx8261:INFO:ExecutionContext - Execution finished in duration=3642 ms

Is there anything I can do to get more information on this error? I have JDK 1.7 u51 installed on the server. Additionally, I have 16GB dedicated to the JVM.

[ShaneNewman · Accepted solution]

It was a problem with the way Splunk handled the .jar file for Teradata. There is a setting that needs to be passed to the odbc connector that the DBX app does not currently have the ability to pass.

[ShaneNewman]

I doubt anyone else will run into the issue. The only reason I did is because we are using Splunk to load entire HL7 messages into a Teradata database for disease reporting.

[ShaneNewman]

It is the setting to pass the max size in characters of the "CLOB" size to be inserted. The default in the odbc jar is 65K, I needed to update it to 2M.

[araitz]

Let me know what that setting is, I haven't seen any bug on this. If you let me know I'll try to ensure this gets addressed.

[araitz]

That is correct, if you open a case with Splunk support it will be routed to the appropriate resources.

[linu1988]

It's Splunk who has developed the app so a case can be opened with any option.

[ShaneNewman]

How would I open a case? With Splunk or with the Splunk DB Connect developer? I do not see Splunk DB Connect listed in the drop-down on the Support Portal.

[araitz]

If you haven't already, can you please open a support case?

[ShaneNewman]

Tried both ways, same result either way...

[linu1988]

did you try the simple query approach?

| dboutput streaming=true  type=sql database=test table=ArchMessage "insert into r_table (field) values ('$field_value$')"

[ShaneNewman]

Was that enough information or do you need more?

[ShaneNewman]

dboutput type=insert streaming=true database=teradata_archmessage table=ArchMessage key=ArchMessageID notFound=ignore

[btsay_splunk]

may I have more information about the settings, the dboutput parameters in this case?

[ShaneNewman]

That cannot be the case because the objects are always present in the target database. It appears to be affecting it for single 1 minute periods of time.

[linu1988]

i guess it tells you the db object doesn't exist. Java is not able to find the object.

[ShaneNewman]

Also, in the target database, all of the fields are nullable. I have put data in this database with and without null fields.