Splunk DB Connect Tail Input command not working

[scc00]

Hi,

I'm trying to use the Tail command for Splunk DB Connect to pull the newest logs into a Splunk Index. Unfortunately, it is not pulling the data, even when I generate new logs. I have tried the DUMP option which works just fine but duplicates the entire database each dump so I don't want to use it. I have configured the Tail option as noted within the documentation and have used the same configurations as I used with the DUMP option but it still does not work. I am not using any specific SQL query either. What am I doing wrong?

[pmagee]

One thing I'm discovering is that the "rising column" and "log date" column names must be specified in ALL CAPS or they won't be recognized. There may be other issues with your particular query as well. I got some insight from checking the $SPLUNK_HOME/var/log/splunk/dbx.log file.

[scc00]

That's probably correct but after a database restart, it started working. I can't say that I can say what the real solution was though. Which is annoying.

[pmagee]

Based on your errors it looks like your connection to the database is failing. I would suspect that there is a space shortage in the database, probably in regards to the audit trail. The audit trail can't expand, so the login fails, which is why the column doesn't show up in the result set.

[scc00]

Well I tried the CAPS option with no results. Though I did check the dbx.log file and found two SQL exceptions. I'm checking with my DBAs but I doubt the database is full. Any other thoughts?

dbx5836:WARN:PooledConnectionFactory - Pooled Connection validation failed: com.splunk.dbx.sql.Database$DatabaseValidationException: Error validating database: java.sql.SQLException: I/O Error: No space left on device
dbx5836:ERROR:TailDatabaseMonitor - Error while executing database monitor: java.sql.SQLException: The column "ERR_ADD_DATE" is not present in the result set