All Apps and Add-ons

DB input stopped after changing rising column field type from int to bigint (DB connect v1.1.7 & MySQL)

mchang_splunk
Splunk Employee
Splunk Employee

Hi, the DB input was working well until I change rising column field type from int to bigint.

We found the following error message.

Find this error message:

2018-12-10 11:18:59.363 dbx2296:ERROR:TailDatabaseMonitor - DBMon Error while executing monitor=[dbmon-tail://host/table1]: com.splunk.dbx.monitor.DbmonException: Value of rising.column=status_id cannot be stored (not serializable)
com.splunk.dbx.monitor.DbmonException: Value of rising.column=status_id cannot be stored (not serializable)
    at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.getNewValue(TailDatabaseMonitor.java:160)
    at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.performMonitoring(TailDatabaseMonitor.java:136)
    at com.splunk.dbx.monitor.DatabaseMonitorExecutor.executeMonitor(DatabaseMonitorExecutor.java:126)

state.xml for this db input:

<list>
<value key="latest.id">
<value class="int">611538309</value>
</value>
</list>

What did I missed?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

The root cause is class type changed so db input can't parse correctly.
Change state.xml as following works

<list>
 <value key="latest.id">
 <value class="big-decimal">611538309</value>
 </value>
 </list>

View solution in original post

0 Karma

tmuth_splunk
Splunk Employee
Splunk Employee

You are aware that DBX 1.x reached End of Life in like 2016, correct?

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

The root cause is class type changed so db input can't parse correctly.
Change state.xml as following works

<list>
 <value key="latest.id">
 <value class="big-decimal">611538309</value>
 </value>
 </list>
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...