Splunk Search

command="dbquery", A database error occurred: ORA-00900: invalid SQL statement

harshavrath
Contributor

Hi,

I'm getting this error

command="dbquery", A database error occurred: ORA-00900: invalid SQL statement

I have connected my oracle DB to Splunk Using "DB Connections in Splunk Manager"

My Java Bridge Server is Running

Under "Explore DB Schema",I'm able to view the table Names & their attributes under "DB Info".

But when i Use the Select Statement under "DB Query" I'm getting the above error.
the query that i used is

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=100

I haven't yet configured the ADD DB Inputs(DB Inputs in SplunkManager)

Any Help is Appreciated

Thanks.

1 Solution

aelliott
Motivator

Did you try Select TOP 1000 * FROM TABLE-NAME

View solution in original post

harshavrath
Contributor

I figured it by reading few other posts Under "DB Query" no need of using below query it gives an error the

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=100

Just SELECT * FROm TABLE-NAME will work

0 Karma

aelliott
Motivator

Did you try Select TOP 1000 * FROM TABLE-NAME

harshavrath
Contributor

Simple Select stmt will work under DB-Query.

0 Karma

harshavrath
Contributor

Even after including the limit field in the double quotes its not working.

0 Karma

linu1988
Champion

Seems like query is wrong

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME Limit 100"

0 Karma

harshavrath
Contributor

Is the Syntax that i used for dbquery correct..?
| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000

0 Karma

harshavrath
Contributor

linu,TABLE-NAME is not my actual table name.

0 Karma

lukejadamec
Super Champion

harshavrath, sorry for the delay. I'm not using dbx anymore, so I can't do any testing. But, you do not need to create database inputs to run database queries. So long as you have established the database connection in database connections you should be good.

The error you're getting specifically says you have an sql problem, and I'm not a real big sql dude. If the query works on the database server, then it should work in dbx query.

0 Karma

linu1988
Champion

TABLE-NAME is this your actual table name?

0 Karma

harshavrath
Contributor

hi luke I'm stuck here help me out..Should i go ahead with ADD DB Inputs(DB Inputs in SplunkManager) is it required if i want to Query the Database from "DB Query".

0 Karma

harshavrath
Contributor

i tried 1000 instead of 100 no change same error.

0 Karma

lukejadamec
Super Champion

When I enter queries in dbx db query they look a lot simpler:
SELECT * FROM TABLE-NAME
For testing, I'd use the default limit of 1000.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...