All Apps and Add-ons

Why is DB Connect Throwing splunkd.log Errors

OldManEd
Builder

I just loaded the Splunk DB Connect app and it is functioning. But going through the WEB UI, and watching the splunkd.log file I'm seeing errors. When I start the app, I go to Explore database schema>Browse through database tables and views>DB Info. Then I'll select a database and a display of tables will appear. I'll select a table at random, then go down to the bottom and select "Show Table Contents..". When I try that, the following errors show up in the log file;

04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':  Exception in thread Thread-1:
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':  Traceback (most recent call last):
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':    File "/opt/splunk/lib/python2.7/threading.py", line 551, in __bootstrap_inner
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':      self.run()
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':    File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 136, in run
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':      bridge.send(data)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':    File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 113, in send
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':      self.sendEncoded('I', data)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':    File "/opt/splunk/etc/apps/dbx/bin/spp/java/bridge.py", line 73, in sendEncoded
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':      self.socket.send(header)
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':    File "/opt/splunk/lib/python2.7/socket.py", line 170, in _dummy
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':      raise error(EBADF, 'Bad file descriptor')
04-14-2014 14:48:09.118 -0600 ERROR ScriptRunner - stderr from '/opt/splunk/etc/apps/dbx/bin/dbquery.py':  error: [Errno 9] Bad file descriptor

But here it gets strange. I get another window and I can actually see the table data.

If I keep the first window open and go back to select another table, no log errors. But as soon as I clear out the browser windows and select any table, I get the errors again.

Anyone have any ideas on what's going on here?

Tags (2)
0 Karma

araitz
Splunk Employee
Splunk Employee

The most likley cause of this error is that a dbquery or dbinput is trying to access a database or table that the user/password for the given database connection does not have permission to.

Chubbybunny
Splunk Employee
Splunk Employee

had a similar problem with our DBX app too; evidently, a poorly crafted SQL that a user had implemented and was found to be the cause.

0 Karma

OldManEd
Builder

This issue is no causing any major problems with searches so as far as I'm concerned, it's closed.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...