About michaelhc

michaelhc · ‎07-30-2020

Thanks for the response. We were on 3.3.0 so I've just updated our setup to 3.3.1 which has changed a few things: Now when I run the large query with no filtering I receive the name and ts columns completely filled, but the rest are empty and there are no errors in search.log. When I append "WHERE event_data.value(N'(event/@timestamp)[1]', N'datetime') < GETDATE() AND event_data.value(N'(event/@timestamp)[1]', N'datetime') > DATEADD(minute,-60,GETDATE())" to the query I get "No results found. Try expanding the time range." and looking at search.log shows the connection aborted error. I have confirmed that this query works on SQL Server Management Studio with and without the time filtering. One thing I tried was creating a stored procedure using the query that works within Management Studio, then using dbxquery to execute that stored procedure, but I still get the same "No results found" output with the connection aborted error. I noticed that when I wasn't filtering by time, the query would return exactly 100,000 results, with the timestamp of the latest being a couple of days ago. I figured this must be why filtering by time wasn't working and thought maybe the extended events file size was causing issues, so I adjusted the max file size and started a new session. This allowed me to run a query with time filtering, which returned less than 100,000 results as expected, but still only had the name and ts fields filled and the connection aborted error in search.log. Is the bug fix you're referring to available in the latest download? If so it unfortunately doesn't seem to have resolved my issue. Out of desperation I tried calling the stored procedure again and weirdly enough that now seems to work and returns all columns complete. The plot thickens...

michaelhc · ‎07-28-2020

Hi, I am attempting to use dbxquery to fetch and transform the results of an extended events session from MSSQL Server 2016 which has been saved to a file. I have three saved searches which follow the same format, two of which work and one which doesn't, and behaves quite peculiarly. When I attempt to run the query below, I get a ChunkedExternProcessor error: 07-28-2020 23:32:01.824 ERROR ChunkedExternProcessor - Failed attempting to parse transport header: ,,,,,,,,,,\r\r 07-28-2020 23:32:01.924 ERROR ChunkedExternProcessor - Error in 'dbxquery' command: Invalid message received from external search command during search, see search.log. | dbxquery query="SELECT event_data = CONVERT(XML, event_data) INTO #<TempTableName> FROM sys.fn_xe_file_target_read_file('<PathToLogFile>/LogFile*',null,null,null) SELECT name = event_data.value(N'(event/@name)[1]', N'varchar(max)'), errorNumber = event_data.value(N'(event/data[@name="error_number"]/value)[1]', N'varchar(max)'), severity = event_data.value(N'(event/data[@name="severity"]/value)[1]', N'varchar(max)'), message = event_data.value(N'(event/data[@name="message"]/value)[1]', N'varchar(max)'), hostname = event_data.value(N'(event/action[@name="client_hostname"]/value)[1]', N'varchar(max)'), username = event_data.value(N'(event/action[@name="username"]/value)[1]', N'varchar(max)'), [sql] = event_data.value(N'(event/action[@name="sql_text"]/value)[1]', N'varchar(max)'), session_id = event_data.value(N'(event/action[@name="session_id"]/value)[1]', N'varchar(max)'), query_hash = event_data.value(N'(event/action[@name="query_hash"]/value)[1]', N'varchar(max)'), database_id = event_data.value(N'(event/action[@name="database_id"]/value)[1]', N'varchar(max)'), client_app_name = event_data.value(N'(event/action[@name="client_app_name"]/value)[1]', N'varchar(max)') FROM #<TempTableName>" connection="<My connection name>" I am confused why my other queries, which follow this same format work, yet this one returns this error. If I reduce the number of fields to just 'name', the error changes to one of two possibilites: 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbxquery_bridge.py", line 90, in <module> 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: main() 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbxquery_bridge.py", line 86, in main 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: bridge.connect() 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbxquery_bridge.py", line 38, in connect 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: self.read_from_dbxquery_server_write_to_stdout() 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbxquery_bridge.py", line 74, in read_from_dbxquery_server_write_to_stdout 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: data = recv(1024 * 1024) 07-28-2020 23:36:16.429 ERROR ChunkedExternProcessor - stderr: ConnectionAbortedError: [WinError 10053] An established connection was aborted by the software in your host machine or, 07-28-2020 23:37:45.389 ERROR ChunkedExternProcessor - Failed attempting to parse transport header: eported,\r\r 07-28-2020 23:37:45.490 ERROR ChunkedExternProcessor - Error in 'dbxquery' command: Invalid message received from external search command during search, see search.log. The name field should read "error reported" so the 'eported' implies some information is being missed, and the connection is being closed too early, but I am not sure why this would occur. Any ideas? Thanks

michaelhc · ‎10-27-2019

Thanks for the response. I had a look at search affinity, and I noticed that it said "For those sites that you want to support search affinity, you must configure multisite clustering so that the site has a full set of searchable data and a local search head." By full set I am assuming this means that a user from remote site A would be able to search data collected from forwarders at remote site B, but that data would be stored at both sites A and B, and the search head at site A would only search through the data stored at site A. Would it be possible for site A to only store data from site A UFs, and site B only stores data from site B UFs? I would like the remote sites to be completely separate from one another, and the only location where one could view data from any site should be the main site. Thanks so much.

michaelhc · ‎10-24-2019

Hey guys, I'm pretty new to Splunk but I've been reading the documentation and trying to understand how I could implement my desired setup. I have several remote sites, which will have a number of UFs at each of them. Additionally, I have one main site from which I want to conduct my searches from. However, I would also like to have the capability for each remote site to search only through its local data. This would be in the case that connectivity to the main site is lost, so that each remote site can function as its own mini setup. Furthermore, if one of the remote sites goes down I still need to be able to perform searches for the indexed data from my main site. For access control reasons I need to ensure that searches made from a remote site can only search data from the same remote site. My original idea was to have several single site indexer clusters each with their own search head, and additionally have a search head at my main site which searches across all of the single site indexer clusters. However, I don't believe this would allow me to continue to conduct searches on indexed data for a remote site from the main site if the remote site were to go down. So I somehow need to replicate the indexed data only from the remote sites to the main site, without replicating from main to remote or remote to remote. I think in theory I could do this by creating an equal number of multi site indexer clusters to my number of remote sites, with the second site being the main site in each, and searching across these, but I feel like there must be a more efficient way of achieving the functionality that I'm looking for. Any suggestions? Thanks for any help, Mike.

Posts	4
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎10-24-2019

Online Status	Offline
Date Last Visited	‎07-30-2020 10:58 PM

Splunk DB Connect - Failed attempting to parse tra...

Remote Site local searches when connection to main...

Re: Splunk DB Connect - Failed attempting to parse...

Splunk DB Connect - Failed attempting to parse tra...

Re: Remote Site local searches when connection to ...

Remote Site local searches when connection to main...