All Apps and Add-ons

Splunk DB Connect 2: How to troubleshoot error "Script execution failed for external search command 'dbxquery'"

jcouture
Explorer
Error in 'script': Script execution failed for external search command 'dbxquery'

My Setup:
I just recently set up a local instance of Splunk Enterprise on my computer. Version: 6.4.1
I also just set up Splunk DB Connect 2 on this same computer. Version: 2.2.0
The server I'm connected to is an Oracle server and I have the most recent drivers (oracle/oracle_service): Version: 11.2

I get this error when I run one of my more lengthy queries against a server I'm connected to. I know the problem doesn't exist on the server end because the same query can be run from a non-local instance of Splunk with success. I also know it's not my connection or credentials because I can run other queries that are shorter without any problem. So it seems to me that there must be something wrong with some part of my settings/install/missing files. I've also tried changing the size allocated by the jvm settings.

If anyone can help me diagnose this that'd be great! Thanks.

0 Karma

woodcock
Esteemed Legend

What do you mean by "smaller"? If you mean that it works when you pull in a few results but fails when you try to pull in a larger set of results, then you are running into the fact that Splunk HARD-CODED an arbitrary limit into dbxquery.py. Here is another Q&A that shows how to bypass it:

https://answers.splunk.com/answers/233222/splunk-db-connect-2-dbxquery-only-returns-1001-row.html

0 Karma

woodcock
Esteemed Legend

Check the dbx2.log (not automatically splunked):

http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Troubleshooting

0 Karma

jcouture
Explorer

dbx2.log isn't recording anything about the long query I'm trying to run. Not an error. Not even an entry with a timestamp. However, when I run a smaller query it seems to be logging correctly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...