Splunk Search

command="dbquery", A database error occurred: ORA-00900: invalid SQL statement

harshavrath
Contributor

Hi,

I'm getting this error

command="dbquery", A database error occurred: ORA-00900: invalid SQL statement

I have connected my oracle DB to Splunk Using "DB Connections in Splunk Manager"

My Java Bridge Server is Running

Under "Explore DB Schema",I'm able to view the table Names & their attributes under "DB Info".

But when i Use the Select Statement under "DB Query" I'm getting the above error.
the query that i used is

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=100

I haven't yet configured the ADD DB Inputs(DB Inputs in SplunkManager)

Any Help is Appreciated

Thanks.

1 Solution

aelliott
Motivator

Did you try Select TOP 1000 * FROM TABLE-NAME

View solution in original post

harshavrath
Contributor

I figured it by reading few other posts Under "DB Query" no need of using below query it gives an error the

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=100

Just SELECT * FROm TABLE-NAME will work

0 Karma

aelliott
Motivator

Did you try Select TOP 1000 * FROM TABLE-NAME

harshavrath
Contributor

Simple Select stmt will work under DB-Query.

0 Karma

harshavrath
Contributor

Even after including the limit field in the double quotes its not working.

0 Karma

linu1988
Champion

Seems like query is wrong

| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME Limit 100"

0 Karma

harshavrath
Contributor

Is the Syntax that i used for dbquery correct..?
| dbquery "DB___NAME" "SELECT * FROM TABLE-NAME" LIMIT=1000

0 Karma

harshavrath
Contributor

linu,TABLE-NAME is not my actual table name.

0 Karma

lukejadamec
Super Champion

harshavrath, sorry for the delay. I'm not using dbx anymore, so I can't do any testing. But, you do not need to create database inputs to run database queries. So long as you have established the database connection in database connections you should be good.

The error you're getting specifically says you have an sql problem, and I'm not a real big sql dude. If the query works on the database server, then it should work in dbx query.

0 Karma

linu1988
Champion

TABLE-NAME is this your actual table name?

0 Karma

harshavrath
Contributor

hi luke I'm stuck here help me out..Should i go ahead with ADD DB Inputs(DB Inputs in SplunkManager) is it required if i want to Query the Database from "DB Query".

0 Karma

harshavrath
Contributor

i tried 1000 instead of 100 no change same error.

0 Karma

lukejadamec
Super Champion

When I enter queries in dbx db query they look a lot simpler:
SELECT * FROM TABLE-NAME
For testing, I'd use the default limit of 1000.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...