Splunk Search

Splunk DB Connect 1: Why am I getting error "command="dbquery", A database error occurred: Invalid Fetch Size"?

DanielFordWA
Contributor

Hi,

I keep getting the following error in DB connect 1. I have setup the External Database and can use it for lookups in search, but any large manual queries or Database inputs do not work.

Error

command="dbquery", A database error occurred: Invalid Fetch Size

I am running Splunk on the below.

jre6
WindowsServer2008R2

How can I fix this with my current setup?

Will switching to jre8 and DB Connect 2 sort this out?

Ticking the 'limit to 1000 results' results in the query working every time, but this is not really a resolution to the issue.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

dbquery (and dbxquery in DB Connect 2) are designed for interactive browsing of small data sets. The assumption has been that you'd index the data if you need to do big data manipulation tasks.

0 Karma

DanielFordWA
Contributor

Thanks for the reply.

I need to enrich around 10,000 clients at a time for ad hoc queries. The entire DB contains around 170,000 clients with 25 columns of info.

"The assumption has been that you'd index the data if you need to do big data manipulation tasks"

How do you advise I do this?

I had mistakenly assumed that with DBconnect I can pull the entire DB and index it, then pull the changes daily. I was then planning to run searches against the index.

Hope you can help.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>