I just loaded the Splunk DB Connect app and it is functioning. But going through the WEB UI, and watching the splunkd.log file I'm seeing errors. When I start the app, I go to Explore database schema>Browse through database tables and views>DB Info. Then I'll select a database and a display of tables will appear. I'll select a table at random, then go down to the bottom and select "Show Table Contents..". When I try that, the following errors show up in the log file;
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': Exception in thread Thread-1:
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': Traceback (most recent call last):
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': File "/opt/splunk/lib/python2.7/threading.py", line 551, in __bootstrap_inner
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': self.run()
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 136, in run
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': bridge.send(data)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 113, in send
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': self.sendEncoded('I', data)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 73, in sendEncoded
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': self.socket.send(header)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': File "/opt/splunk/lib/python2.7/socket.py", line 170, in _dummy
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': raise error(EBADF, 'Bad file descriptor')
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py': error: [Errno 9] Bad file descriptor
But here it gets strange. I get another window and I can actually see the table data.
If I keep the first window open and go back to select another table, no log errors. But as soon as I clear out the browser windows and select any table, I get the errors again.
Anyone have any ideas on what's going on here?
The most likley cause of this error is that a dbquery or dbinput is trying to access a database or table that the user/password for the given database connection does not have permission to.
had a similar problem with our DBX app too; evidently, a poorly crafted SQL that a user had implemented and was found to be the cause.
This issue is no causing any major problems with searches so as far as I'm concerned, it's closed.