Deployment Architecture

Is there a limit to the number of records that dboutput can update at a time?

NigelCooke
Explorer

I occasionally get this error when using the dboutput command :

command="dboutput", Unexpected error while performing dboutput: java.lang.ArrayIndexOutOfBoundsException: 100

It appears to relate to the number of records that the command is trying to update. Certainly, whenever the command succeeds the record count is less than 101. I have applied a "| head 100" command to ensure the record count is 100 or less. This seems to be successful in avoiding the error but I am now losing records.

If there is a limit it should be configurable should it not? In this case it looks like the source is hard coded for 100 records and is failing rather than a limit being applied.

Am I interpreting this error correctly?

1 Solution

Lucas_K
Motivator

Might be batch size.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/javaspec

[dboutput]
batch.size = <n>

More info in this post : http://answers.splunk.com/comments/88886/view.html

Seems to suggest that type=update uses the batch setting as the total it will support where as type=insert will use the setting as many times as required.

View solution in original post

0 Karma

NigelCooke
Explorer

That stopped it. I added the block

[dboutput]
batch.size = 110

to the java.conf file and restarted Splunk. I ran some tests and the error now happens at 110 as set.

Thanks for your help.

0 Karma

Lucas_K
Motivator

Might be batch size.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/javaspec

[dboutput]
batch.size = <n>

More info in this post : http://answers.splunk.com/comments/88886/view.html

Seems to suggest that type=update uses the batch setting as the total it will support where as type=insert will use the setting as many times as required.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...