Getting Data In

Splunk DB Connect: Why am I getting an error trying to select a column for my dbmon-tail input?

sim_tcr
Communicator

Hello,

I am trying to setup a tailing query using Splunk DB Connect app.

My query is:

select * from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}} 

and it works.

Now i am trying to change it to selected column only as below and while trying to save the database input, I get an error.

select APPLICATION_NM from  table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

Error is:

03-20-2015 06:59:50.313 -0400 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://XXX/XXX-date: Unrecognized or ambiguous rising column name [CREATED_DT] is used. For Oracle database, qualified column name cannot be used, use " ()" instead.\n with query = select APPLICATION_NM from XXXXXXXX WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') \nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n    hand.execute(info)\n  
File "/Splunk/splunk/lib/python2.7/site-packages/splunk/admin.py", line 528, in execute\n    if self.requestedAction == ACTION_EDIT:     self.handleEdit(confInfo)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 238, in handleEdit\n    self.handleModification("edit", output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/config.py", line 218, in handleModification\n    id, props = self.process_modification(id, props, type=type, output=output)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 95, in process_modification\n    self.validateConfig(stanza, props)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/rest_handler_dbmon.py", line 126, in validateConfig\n    executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\n  
File "/Splunk/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 182, in executeBridgeCommand\n    raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\n\n

Can any one assist?

0 Karma

mzorzi
Splunk Employee
Splunk Employee

try with:

{{ WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') AND $rising_column$ > ?}}

0 Karma

sim_tcr
Communicator

it work only if i do select *. Not if I do SELECT somecolumn

0 Karma

sim_tcr
Communicator

one more observation.
i could save select CREATED_DT from table WHERE CREATED_DT > TO_DATE('03/20/2015 05:11:51','mm/dd/yyyy hh24:mi:ss') {{AND $rising_column$ > ?}}

That is whatever my tailing column i can select that coumn only. Or i have to do select *

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...