Splunk Search

Splunk DB Connect v1 connects to the database successfully but returns no results when I try any query

logmar5
Explorer

I have installed Splunk DB Connect v1 App and MySQL driver and configured them with my database details. Looks like connection works successfully. If I look at "Database Info", I can select my database from the dropdown and it shows available tables. However, if I try to run any query, it never completes -- just hangs there with "Waiting for search to complete...".

I am looking at dbx.log but it doesn't show any obvious ERRORs. Just perhaps "file null doesn't exist", but not sure what that would mean for me:

2015-06-19 01:51:03.159 dbx1930:DEBUG:DatabaseQueryCommand - infoPath not in command headers... reading it from job sid=null directly...
2015-06-19 01:51:03.160 dbx1930:WARN:DatabaseQueryCommand - SearchResultsInfo file null doesn't exist
2015-06-19 01:51:03.160 dbx1930:DEBUG:DatabaseQueryCommand - srInfo: null
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Fetching connection from factory...
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Fetching connection from pool...
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Activating database connection com.mysql.jdbc.JDBC4Connection@17574841 for database=FIX_DB
2015-06-19 01:51:03.160 dbx1930:DEBUG:PooledConnectionFactory - Validating database connection for database=FIX_DB
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Validating database connection...
2015-06-19 01:51:03.160 dbx1930:DEBUG:Database - Executing test query: SELECT 1
2015-06-19 01:51:03.162 dbx1930:DEBUG:Database - Database validation successful
2015-06-19 01:52:41.335 dbx8318:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx8318
2015-06-19 01:52:41.335 dbx8318:DEBUG:Splunkd - Requesting Splunkd REST service keep-alive...
2015-06-19 01:52:41.335 dbx8318:DEBUG:Splunkd - Performing Splunkd Request: RESTRequest{GET authentication/current-context/context}
2015-06-19 01:52:41.354 dbx8318:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-06-19 01:52:41.354 dbx8318:DEBUG:ExecutionContext - Destroying execution context...
2015-06-19 01:52:41.354 dbx8318:INFO:ExecutionContext - Execution finished in duration=20 ms
2015-06-19 01:57:41.354 dbx5522:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx5522
2015-06-19 01:57:41.355 dbx5522:DEBUG:Splunkd - Requesting Splunkd REST service keep-alive...
2015-06-19 01:57:41.355 dbx5522:DEBUG:Splunkd - Performing Splunkd Request: RESTRequest{GET authentication/current-context/context}
2015-06-19 01:57:41.364 dbx5522:INFO:Splunkd - Splunkd REST Keep-alive successful for user splunk-system-user
2015-06-19 01:57:41.364 dbx5522:DEBUG:ExecutionContext - Destroying execution context...
2015-06-19 01:57:41.364 dbx5522:INFO:ExecutionContext - Execution finished in duration=10 ms

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

that sounds like you're browsing the database successfully but haven't actually built an input to index data with. You're probably very close to success.

0 Karma

hogan24
Path Finder

have you tried running something simple from the search screen like this:

| dbquery dbConnectionName  "select sysdate from dual"

This would return something immediately and validate if the connection to your db is actually in tact.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...