I believe you are running into queue blockage. HecEventWriter.writeRecordHecEventWriter.writeRecords Have you checked the metrics log on the HF to see if you are blocking on the indexing queue?
... View more
This is a known issue in DB Connect version 2.1.1 and is fixed in version 2.2.0
http://docs.splunk.com/Documentation/DBX/2.2.0/ReleaseNotes/Releasenotes#Fixed_issues
DBX-2646 Slashes (/) in SQL silently break the query.
... View more