All Apps and Add-ons

Splunk DB Connect upgrade: SQL Query for pulling Oracle audit trails stopped working

smcbride27
Explorer

After upgrading to DBX 3.1.1 from DBX 2.3.x My SQL query for pulling Oracle audit trails no longer works. I'm using a converted time stamp based off of the event time stamp for the rising column, and I've added in the additional WHERE statement to the query, per the guidelines. The query works in batch mode, but errors out when I select rising column. Any help would be greatly appreciated.

0 Karma

smcbride27
Explorer

It turns out that I found a bug with support. They went back to the developers and we have a work around.

0 Karma

Venkat_16
Contributor

We have the similar issue on DB Connect 2.4.x as well.
Could you please share the workaround?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So others might benefit, please share the workaround.

---
If this reply helps you, Karma would be appreciated.
0 Karma

smcbride27
Explorer

To work around the rising column issue non indexable columns need to be skipped in the sql query. (For me this was specifically for the audit trails on an Oracle Exadata). This was done by editing the sql queries manually in the $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local directory in the db_inputs.conf file

Skipping columns causes a shift in the rising column index, so the checkpoint files need to be cleaned up as well. These files are under $SPLUNK_HOME/var/lib/splunk/modinputs/server/splunk_app_dbconnect

Note: Some of the above files and locations do NOT exist until the app is upgraded, and the migration completed.

0 Karma

smcbride27
Explorer

This is the error that I'm getting: java.sql.SQLException: Missing IN or OUT parameter at index:: 1

0 Karma

Venkat_16
Contributor

Any updates on the resolution please?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...