I have actually found the issue here. Your problem is your collection.conf: [samplecollection] replicate = true You don't specifically state the columns in your collection. I just got this app and I immediately looked at my current setup through it. Every time I am missing a column it's a column that I don't enforce a type with in collections.conf. The _key column seems to just be a given. ... View more

Sort of. I pull data under a rolling window. So, for me, I pull the data in the last 24 hours with the rising column. This limits the data that it has to go through consistently. I also pull the data every 2 minutes. Now this means that it pulls all the data every time but the internal check keeps only the new data coming in. The additional reason I pull for 24 hours is just a safety issue. If something goes wrong and I can't pull data, this gives us a deadline to fix it. Your limits may vary for your application but that's how I did it. ... View more

So I did tests with various functions in this list and it would appear that functions that take arguments will fail outright but the ones that don't will give.... unexpected results. The following will all give the same answer: index=summary title=lead_summary _time<now() index=summary title=lead_summary _time<true() index=summary title=lead_summary _time<false() index=summary title=lead_summary _time<pi() If you put greater than or you put equals to, they fail. This is an obvious bug since, at the very least, pi() shouldn't even be comparable to _time. It would appear Iguinn is only partially right, but the documentation does not reflect that. The documentation states, You can use these functions with the eval, fieldformat, and where commands, and as part of evaluation expressions. This does not state: You must use those in eval, fieldformat, and where commands. This should be clarified. As I do not have the ability to make this the answer, hopefully, others will see this full and complete answer. ... View more

now() is also a function but when I search for _time less than now() it finds all events. Conversely, when I search for _time greater than now() it finds nothing, as expected. So what "functions" can you use without where and eval? Obviously, now() is in that list. Here is the complete list of functions for your reference: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions Notice in Date and Time functions section both strftime and now are both listed. ... View more

Also note that many people are saying that this error can come and go so this may not be the end-all solution. ... View more

I had this same issue with Splunk version : 6.3.0 DBConnect Version : Splunk DBConnect v2 2.0.4 RAM memory :16 GB No. of cores : 2 Physical Memory: 500 GB No of concurrent users : 1 I only have 4 inputs right now. I tried quadrupling the timeout from 30s to 120s but I saw even worse performance and it took longer to get data as the underlying problem was that requests were timing out so this just made it take longer to time out and disable the inputs. I recently updated Splunk DBConnect v2 to 2.2.0. So far, I have not seen that error occur again. It may be something that was addressed in the new update. Admittedly, there was a 500 error at the end of the update but after restarting Splunk, skipping the initial setup step that DB Connect brought up, and verifying that all inputs and connections were still correct, I have seen markedly better performance overall. I have also not even seen a retry notice for my inputs since the update, which was the precursor to the inputs being disabled. Updating the app would be my suggested course of action. Oh, and before the update I also made myself an alert to let me know if it ever happens again so I can turn them back on and investigate: index=_internal sourcetype=dbx2 "disabling modular input" It runs every 5 minutes and looks back 5 minutes so I know pretty quickly when it happens. This has not gone off since the update. ... View more

A couple questions about this: 1) How many rows are you expecting from your lookup? When you say apart from the fact that I am only getting partial (if any) results in the Preview , it sounds like you are not pulling all the rows you are expecting to or there simply is no translation in the lookup for those rows. 2) Does you db lookup work for a time and then starts giving you this error or does it happen immediately? Based off the Preview issue, I suspect immediately. 3) Are you running multiple indexers? I got this error for, probably, a different reason and mine did not mention the indexer, probably because I am only running one. I ask because this may not be a symptom of your problem. ... View more

That was my first thought but I noticed this in the description of the problem: The problem is I dont't want to resolve all hostnames before drawing a chart (some thousands of ip addresses - it'd take many minutes), only top ten just after selecting top ten addresses. So I did not give that as a response. ... View more

Only problem with the above is that OTHER from the first timechart will come back with NULL in the second since OTHER is probably not in your lookup. If you put the lookup translation in there as well, it should work. ... View more

I have found a way to do this, sort of. I did an untable that was recommended to be able to search a timechart. So in yours, you would most likely need something like the following: sflow | eval bytes = formatbytestom(bytes) | timechart limit=50 sum(bytes) by src_ip | untable _time, src_ip, sum | lookup ip_lookup ip as src_ip output host as src_ip | timechart sum(sum) by host You may have to play with it but that is the basis of what I did. Untable will pull the header values into a column, manipulate that, and then put it back into a timechart. ... View more

I had the same issue but I did not have that file path mentioned. Mine was called db_connections.conf in that directory. That setting was not in there either. So I placed the setting in there but just doing that did not work. I had to restart Splunk after that; not sure if they had to but they didn't mention it. Anyway, after putting that setting in and restarting Splunk, my connection started working again. ... View more

It would seem so. I have workarounds in place and they seem to be working well. Mostly I am just limiting by time and making sure that only data over a rolling time frame is being pulled. I am using the advanced query section to ensure this. ... View more

I have seen this problem too. I could not get the lookup table to get me any more than a set amount of rows. I also did not see anyone in the forums who had a solution to this. I assume there are settings for this but I cannot locate them What I did was put the data into the input as another column instead of pulling from a lookup table. I only use lookup tables for small sets of translations, usually <1000 rows. The error code you are seeing is not really an error. It's more of a warning. It's saying that not all the values corresponded to values in the lookup table and therefore the results "may be incorrect". ... View more

I am seeing this too. You can use the FROM_UNIXTIME(o.date) to get the UTC readable version of the int. If you want to convert that to your timezone, I am not sure how to do that when just pulling the data in with MySQL since DB Connnect 2, the one I am using will not allow a query with CONVERT_TZ to actually be used and return results (this is true at the time I am typing this an may be corrected later). You can however do that after the fact in the Splunk queries. You probably have already figured this out but I thought it may be helpful for anyone else seeing this. ... View more

I am getting the same activity through the interface itself. In the Set Parameters section of input creation, you can specify a unix timestamp as your Timestamp. I would like that to be displayed as yyyy-MM-DD HH:mm:ss as I specified in Output Timestamp Format selection. I would think that it would take the unix timestamp column that I specified and convert that to the appropriate format. Is this not the case and if not, why does it not give an error here? ... View more

Can you verify that the query is actually being sent to the target database? I am having an similar unresolved issue with using the CONVERT_TZ function. That issue is here: https://answers.splunk.com/answers/386612/splunk-db-connect-2-blocking-mysql-function.html . My query was not even getting the target database. In my case, it was seemingly Splunk DB Connect 2 that was automatically doing this before even sending the query to the DB. ... View more

I downvoted this post because their answer was basically, "it doesn't do that. we would know if it does.". that is not an answer. that is a dismissal. ... View more

I have noted the exact same behavior in my tests and posted a similar question to that effect: https://answers.splunk.com/answers/386332/db-connect-2-inefficient-querying.html I gave a bit more information on my tests over this. Hopefully, they will give me more of an answer than "It doesn't do that" when clearly, it does. At least that is what it is currently doing. ... View more

I downvoted this post because the link included in the post goes to a 404 page in splunk. ... View more