All Apps and Add-ons

Splunk DB Connect 2: How to troubleshoot error "Script execution failed for external search command 'dbxquery'"

jcouture
Explorer
Error in 'script': Script execution failed for external search command 'dbxquery'

My Setup:
I just recently set up a local instance of Splunk Enterprise on my computer. Version: 6.4.1
I also just set up Splunk DB Connect 2 on this same computer. Version: 2.2.0
The server I'm connected to is an Oracle server and I have the most recent drivers (oracle/oracle_service): Version: 11.2

I get this error when I run one of my more lengthy queries against a server I'm connected to. I know the problem doesn't exist on the server end because the same query can be run from a non-local instance of Splunk with success. I also know it's not my connection or credentials because I can run other queries that are shorter without any problem. So it seems to me that there must be something wrong with some part of my settings/install/missing files. I've also tried changing the size allocated by the jvm settings.

If anyone can help me diagnose this that'd be great! Thanks.

0 Karma

woodcock
Esteemed Legend

What do you mean by "smaller"? If you mean that it works when you pull in a few results but fails when you try to pull in a larger set of results, then you are running into the fact that Splunk HARD-CODED an arbitrary limit into dbxquery.py. Here is another Q&A that shows how to bypass it:

https://answers.splunk.com/answers/233222/splunk-db-connect-2-dbxquery-only-returns-1001-row.html

0 Karma

woodcock
Esteemed Legend

Check the dbx2.log (not automatically splunked):

http://docs.splunk.com/Documentation/DBX/2.2.0/DeployDBX/Troubleshooting

0 Karma

jcouture
Explorer

dbx2.log isn't recording anything about the long query I'm trying to run. Not an error. Not even an entry with a timestamp. However, when I run a smaller query it seems to be logging correctly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...