Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stefan_d
stefan_d
Path Finder
Member since:
05-15-2018
03-08-2021
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 7 |
| Member Since | 05-15-2018 |
Activity Feed
- Got Karma for Re: Error with DBConnect App Inputs Verion:3.1.4. 11-27-2023 10:33 AM
- Got Karma for Re: Is it possible to use SAML, LDAP and Splunk authentication at the same time?. 03-09-2021 04:48 AM
- Posted Re: Is it possible to use SAML, LDAP and Splunk authentication at the same time? on Security. 03-08-2021 12:48 AM
- Karma Re: How to display values only for Chart overlay fields but not for other fields in bar chart for BernardEAI. 02-09-2021 05:33 AM
- Got Karma for Re: How do you send lookup CSV from a forwarder to a search head?. 12-17-2020 04:22 AM
- Got Karma for Re: Error with DBConnect App Inputs Verion:3.1.4. 11-25-2020 07:28 AM
- Tagged Re: Error with DBConnect App Inputs Verion:3.1.4 on All Apps and Add-ons. 11-13-2020 04:58 AM
- Tagged Re: Error with DBConnect App Inputs Verion:3.1.4 on All Apps and Add-ons. 11-13-2020 04:58 AM
- Posted Re: Error with DBConnect App Inputs Verion:3.1.4 on All Apps and Add-ons. 11-13-2020 04:56 AM
- Got Karma for Re: Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection. 11-11-2020 12:57 AM
- Posted Re: Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection on All Apps and Add-ons. 07-09-2020 11:27 PM
- Got Karma for Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection. 06-30-2020 07:26 AM
- Got Karma for Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection. 06-05-2020 12:51 AM
- Karma Is possible to use more than one IDP with splunk SSO ? for joaquim. 06-05-2020 12:50 AM
- Karma How to sort on single value in trellis? for timmym123. 06-05-2020 12:49 AM
- Karma Re: DB Connect 3.1.1 Data Duplication? for matthewsenour. 06-05-2020 12:49 AM
- Karma Re: Remove unused columns in trellis charts for cmerriman. 06-05-2020 12:49 AM
- Karma Is there a way to display more than 20 charts at a time using new trellis layout? for ksarpol. 06-05-2020 12:48 AM
- Posted Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection on All Apps and Add-ons. 04-10-2020 04:45 AM
- Tagged Splunk DB Connect 3.3.0 getting java.lang.NullPointerException trying to setup MS SQL connection on All Apps and Add-ons. 04-10-2020 04:45 AM
Topics I've Started
thanks for raising the enhancement request! Another reason for this requirement would be to have CLI authentication requests served via LDAP(not possible with SAML as the password is not sent with request) and not have to rely on locally managed Splunk accounts.
... View more
11-13-2020
04:56 AM
2 Karma
Hi I also got this error after my input has been running fine for a while. In my case, I think it's a bug (or new design feature 🙂 ) that has to do with how DBConnect internally 'caches' the structure of the SQL table/view data for the input. My input query used a rising column and looked something like: SELECT * FROM "ABC-VIEW"
WHERE lastModifiedDate > ?
ORDER BY lastModifiedDate ASC As I mentioned, all worked well, until one sunny day that I got this error: xxxxxxxx +0200 [QuartzScheduler_Worker-19] ERROR org.easybatch.core.job.BatchJob - Unable to process Record: {header=[number=5983, source="xxxxx", creationDate="xxxxxx"], payload=[HikariProxyResultSet@2004807770 wrapping SQLServerResultSet:150443]} java.lang.IndexOutOfBoundsException: Index: 33, Size: 32 at java.util.ArrayList.rangeCheck(ArrayList.java:657) at java.util.ArrayList.get(ArrayList.java:433) at com.splunk.dbx.server.dbinput.task.processors.EventMarshaller.formatEvent(EventMarshaller.java:99) at com.splunk.dbx.server.dbinput.task.processors.EventMarshaller.toJson(EventMarshaller.java:73) at com.splunk.dbx.server.dbinput.task.processors.EventMarshaller.processRecord(EventMarshaller.java:46) at com.splunk.dbx.server.dbinput.task.processors.EventMarshaller.processRecord(EventMarshaller.java:25) at org.easybatch.core.processor.CompositeRecordProcessor.processRecord(CompositeRecordProcessor.java:38) at org.easybatch.core.job.BatchJob.processRecord(BatchJob.java:179) at org.easybatch.core.job.BatchJob.readAndProcessBatch(BatchJob.java:152) at org.easybatch.core.job.BatchJob.call(BatchJob.java:78) at org.easybatch.extensions.quartz.Job.execute(Job.java:59) at org.quartz.core.JobRunShell.run(JobRunShell.java:202) at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) After some investigation, the DB Admin informed me that the structure of the view changed (columns were added). I saved the input (open, execute SQL, next, save) via the GUI and it started working again. For me it was a nice capability to setup a DB input with "Select * ..." and brag about Splunk capable of handling DB changes on the fly. But I subsequently had to swallow the brag as it turns out in DBConnect V3x things can break: when the rising column's position change ..and now it seems when the column/view structure changes Would like to hear if anyone else came accross this or can give a better explanation. Happy Splunking! S
... View more
07-09-2020
11:27 PM
1 Karma
Hi @tallan I can't say for sure, but it seems like there's a bug in the error handling masking the real error message. I'm not sure if it is the case for all errors. We eventually downgraded the app and then got an error message indicating incorrect credentials. Turned out that DBA gave us the wrong info. We corrected and upgraded, it's running fine now. Currently running 3.30 I checked the release notes known issue-> 2020-06-24 DBX-5099 Error handling a request: java.lang.NullPointerException: null
... View more
04-10-2020
04:45 AM
2 Karma
Hi
Please help!
I've been struggling to configure a Splunk DB Connect connection to connect to an MS SQL 2008 DB.
I suspect it's a JVM / JDBC driver issue but just cannot win this one.
When trying to save the connection using the UI I get the following message:
"There was an error processing your request. It has been logged (ID 239a7f9b0a5bb917)."
The ID corresponds to the stack trace in the log, shown below.
Installation:
CentOS Linux 7 (Core)
Single-instance Splunk Enterprise Version: 8.0.2
Splunk DB Connect 3.3.0
OpenJDK 1.8.0 64-Bit Server VM (build 25.242-b08, mixed mode)
(also tried openjdk-11.0.6.10-1.el7_7.x86_64)
Tried these JDBC drivers downloaded from Microsoft:
sqljdbc_6.2/enu/mssql-jdbc-6.2.2.jre8.jar
sqljdbc_4.2/enu/jre8/sqljdbc42.jar
I've tried setting the log level to DEBUG using the UI, but it gives an error. I've set the log level stanzas but unable to see any DEBUG level logs:
local/dbx_settings.conf
[loglevel]
connector = DEBUG
processor = DEBUG
and also
local/dbx_logging.conf
[logger_dbx]
level=DEBUG
[logger_splunk]
level=DEBUG
This error is logged (splunk/var/log/splunk/splunk_app_db_connect_server.log):
[dw-56 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: 239a7f9b0a5bb917
java.lang.NullPointerException: null
at com.splunk.dbx.connector.logger.AuditLogger.replace(AuditLogger.java:50)
at com.splunk.dbx.connector.logger.AuditLogger.error(AuditLogger.java:44)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getStatus(DatabaseMetadataServiceImpl.java:159)
at com.splunk.dbx.server.api.service.database.impl.DatabaseMetadataServiceImpl.getConnectionStatus(DatabaseMetadataServiceImpl.java:116)
at com.splunk.dbx.server.api.resource.ConnectionResource.getConnectionStatusOfEntity(ConnectionResource.java:72)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:124)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:167)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:79)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:469)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:391)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80)
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:253)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:232)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:680)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:392)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:346)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:365)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:318)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
at io.dropwizard.jetty.NonblockingServletHolder.handle(NonblockingServletHolder.java:50)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1617)
at io.dropwizard.servlets.ThreadNameFilter.doFilter(ThreadNameFilter.java:35)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.handle(AllowedMethodsFilter.java:47)
at io.dropwizard.jersey.filter.AllowedMethodsFilter.doFilter(AllowedMethodsFilter.java:41)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at com.splunk.dbx.server.api.filter.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:30)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:545)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1297)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1212)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at com.codahale.metrics.jetty9.InstrumentedHandler.handle(InstrumentedHandler.java:249)
at io.dropwizard.jetty.RoutingHandler.handle(RoutingHandler.java:52)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:717)
at org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:54)
at org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:173)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
at org.eclipse.jetty.server.Server.handle(Server.java:500)
at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383)
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:270)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:388)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938)
at java.lang.Thread.run(Thread.java:748)
... View more
02-24-2020
02:53 AM
Hi
I have a similar issue.
It seems to be connected with the search term and the use of the dedup.
search producing problem:
index=index_*
|dedup HOSTNAME POLICY_NAME
The result populates a field COMP_SUMMARY_FAILURE_NAME with source::xxx|host::yyy|zzz
where xxx= value for source, yyy= value for host, zzz=value for sourcetype
The result is reproducible for a subset of events and always for this field.
This does not happen when:
- adding more specific terms, e.g. HOSTNAME=blabla
- not using a wildcard for the index, e.g. index=index_specific
- not using dedup, then the result returns multiple events with the field in question containing no values
smells like a bug?
... View more
01-26-2020
12:37 AM
1 Karma
Hi
Is there is perhaps there new capability that allows for this requirement? Ingesting DB data to use for lookups is an option, but I don't think ideal. It consumes license, also additional effort/processing to setup, store and maintain the data in the IDX/C.
I have a similar requirement (and surely it's widely needed) where the DB data source is not reachable to the SH or SHC. All we need is a csv lookup generated from the dbxquery ran on the HF and to forward the object to the SH/C and/or IDX/C.
I suppose one could build a script to achieve this but I rather feel that this could be a helpful feature?
... View more
01-16-2019
02:19 AM
Same error and some other timeout errors. running 7.2.3 on VMWare.
How do I prove fault at virtual infrastructure or application...
... View more
09-17-2018
12:06 PM
Hi,
I would like to increase the number of single values per page in the trellis view. It seems that the limit is 20.
Any ideas, please?
... View more
07-31-2018
07:21 AM
Hi there!
Have you managed to solve this problem?
I also have a similar issue, is it possible to grab the JSON data from a column in your DB input?
... View more
07-17-2018
11:06 PM
Thanks for sharing!
... View more
07-17-2018
04:49 AM
We're also looking for a similar solution!
... View more
05-15-2018
03:32 AM
And also what about the other direction?
Is anyone pushing inventory data from Splunk into uCMDB?
Not sure if the use case would make sense from a license cost perspective, but if you're already using a Splunk agent on a server can one not collect inventory type data (say once a week) via Splunk and use uCMDB's REST API to populate the CI in uCMDB? I think this could save the admin effort and license for using uCMDB's universal discovery agent/probe to collect data and update the CI.
I guess it depends on the integration effort. Also, this won't work if more than simple inventory data collection is required..
thoughts?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2021
04:08 AM
|
Karma given to
