All Apps and Add-ons

Splunk DB Connect 2: Why isn't my DB lookup returning any data?

chustar
Path Finder

I'm currently trying to set up a lookup against a SQL Server DB using dblookups.

I went through the UI for DB Connect 2 and set up the lookup. Everything works fine, the UI suggestions and previous and all properly populated, but when it comes to the "Preview Your Lookup" the new column that I want is blank.

I checked that the value I'm using for my key does exist on the database and it does.
One thing I noticed is that the field in the DB is defined as an int, which may be confusing to Splunk?

jcoates_splunk
Splunk Employee
Splunk Employee

Guessing at which ticket is being referenced... but if I'm seeing the right one, the root cause appears to be time. Preview tasks have one time range, lookup cache inputs have another, and the source data may or may not line up as expected. Does that make sense in your case muebel?

0 Karma

muebel
SplunkTrust
SplunkTrust

Although the preview functionality might be bugged, do you get any data once you've established the input? Can you run test queries against the database?

0 Karma

todd_miller
Communicator

I've tried running test queries against the database and I'm still having issues pulling back data using the connection. It seems to now want to use my search peers (the indexers) to do the query execution. This ends up failing because DBXv2 isn't installed on the Indexers. I no longer have issues with the lookups because I can't get that far. I was originally getting an issue with DBXv2.0.4 where no lookup data was returned. Now I can't even get data to return from my SQL Query.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

DB Connect doesn't belong on Indexers... I don't know if you're seeing a misconfiguration or a bug, but that's not desired behavior.

0 Karma

todd_miller
Communicator

Yup. That's why I only put it on the Search Heads. I also tried it on a standalone search head (i.e. no search peers defined) and it worked to query the DB and return data from the DB. When I added the search peers in (i.e. the indexers) to the distributed search configs, it started returning this:

[name_of_indexer_1of10] Streamed search execute failed because: Error in 'script': Getinfo probe failed for external search command 'dbxquery' ,

0 Karma

todd_miller
Communicator

I'm having this issue as well. All troubleshooting and documentation has been provided as part of a Splunk case. Fortunately, support was able to replicate the issue and has opened a bug with development however I was not provided the bug-ID nor an indication as to when it would be fixed.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...