Splunk Search

dbx query throwing error

sravani27
Path Finder

Hi,

I am trying to run dbxquery command but it keeps throwing the below error.  I have configured the database connection on a heavy forwarder on the DB Connect add-on and I am running the query on a search head. I have verified that the username and password are working fine. Can someone help me understand what I am missing?

error: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: ORA-02002: error while writing to audit trail ORA-55917: Table flush I/O failed for log ID: 3 bucket ID: 0 ORA-55917: Table flush I/O failed for log ID: 3 bucket ID: 0 ORA-01918: user 'ORA-01918: user '' does not exist ORA-28001: the password has expired ' does not exist ORA-28001: the password has expired

 

query: | dbxquery maxrows=200000 query="SELECT SERVER_NAME, HOST_NAME, MEMORY, OS, SERVER_ENV, TCPIPADDRESS, PROJECT, LOCATION, BUILDING_CODE, COUNTRY, MAKE, MODEL, BOX, GRID, AC_ASSET_TAG, STATUS, OS_SG, DB_SG, SUPPORTCONTRACTS, MC_CS_IP, MC_TS_IP, SERVER_CONTACT, SERVER_CATEGORY FROM \"ASSETMANAGER\".\"AMASSET_SUPPORT_VIEW\"" connection="FCAMS"

Thanks

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You say the username and password are working fine, but the error message clearly disagrees.  Ask your DBA to reset the password.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sravani27
Path Finder

I was able to connect with the password and run the query on the heavy forwarder in DB connect successfully without any issues. But when I try to execute the query on the search time on my search head, it throws this error.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...