Howdy Splunkers,
After creating a new database input through the DB connect GUI, the query keeps returning the same values, and the checkpoint value is not updating.
Log search:
index=_internal host=[db_connect_host] sourcetype=dbx_server DbInputCheckpointRepository
Log messages:
2020-03-09 17:15:00.253 -0400 [QuartzScheduler_Worker-5] INFO c.s.d.s.dbinput.task.DbInputCheckpointRepository - action=load_checkpoint_from_cache checkpoint=Checkpoint{value='9090000', appVersion='3.1.2', columnType=2, timestamp='2020-03-09T17:06:32.535-04:00'}
2020-03-09 17:15:00.254 -0400 [QuartzScheduler_Worker-5] ERROR c.s.d.s.dbinput.task.DbInputCheckpointRepository - action=unable_to_save_checkpoint
java.io.FileNotFoundException: D:\Program Files\Splunk\var\lib\splunk\modinputs\server\splunk_app_db_connect\[db_connect_input_name] (Access is denied)
at java.io.FileOutputStream.open0(Native Method)
at java.io.FileOutputStream.open(Unknown Source)
at java.io.FileOutputStream.<init>(Unknown Source)
at java.io.FileWriter.<init>(Unknown Source)
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.dumpCheckpoint(DbInputCheckpointRepository.java:206)
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.saveImpl(DbInputCheckpointRepository.java:239)
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.saveCheckpoint(DbInputCheckpointRepository.java:115)
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.save(DbInputCheckpointRepository.java:102)
at com.splunk.dbx.server.dbinput.task.DbInputTask.saveCheckpoint(DbInputTask.java:114)
at com.splunk.dbx.server.dbinput.task.processors.HecEventWriter.writeRecords(HecEventWriter.java:68)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
2020-03-09 17:15:00.254 -0400 [QuartzScheduler_Worker-5] ERROR org.easybatch.core.job.BatchJob - Unable to write records
com.splunk.dbx.server.exception.WriteCheckpointFailException: Error(s) occur when writing checkpoint.
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.saveCheckpoint(DbInputCheckpointRepository.java:121)
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointRepository.save(DbInputCheckpointRepository.java:102)
at com.splunk.dbx.server.dbinput.task.DbInputTask.saveCheckpoint(DbInputTask.java:114)
at com.splunk.dbx.server.dbinput.task.processors.HecEventWriter.writeRecords(HecEventWriter.java:68)
at org.easybatch.core.job.BatchJob.writeBatch(BatchJob.java:203)
at org.easybatch.core.job.BatchJob.call(BatchJob.java:79)
at org.easybatch.extensions.quartz.Job.execute(Job.java:59)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Cheers,
Jacob
Despite running as "Local System", apparently Splunk was unable to update the file. I relaxed the security on this checkpoint file only, and now it updates no problem.
2020-03-09 17:40:01.470 -0400 [QuartzScheduler_Worker-7] INFO c.s.d.s.dbinput.task.DbInputCheckpointRepository - action=save_checkpoint_success checkpoint=Checkpoint{value='9092006', appVersion='3.2.0', columnType=2, timestamp='2020-03-09T17:40:01.436-04:00'}
Despite running as "Local System", apparently Splunk was unable to update the file. I relaxed the security on this checkpoint file only, and now it updates no problem.
2020-03-09 17:40:01.470 -0400 [QuartzScheduler_Worker-7] INFO c.s.d.s.dbinput.task.DbInputCheckpointRepository - action=save_checkpoint_success checkpoint=Checkpoint{value='9092006', appVersion='3.2.0', columnType=2, timestamp='2020-03-09T17:40:01.436-04:00'}