All Apps and Add-ons

Why is Splunk DB Connect 2 causing errors on our database?

chrisduimstra
Path Finder

I have a rising column query running every 15 minutes with the query:

SELECT * FROM "name"

The app appears to be working normally and Splunk is indexing the data from the database. However, our dba's have reported the following set of errors are occurring on the database server at the same 15 minute interval when the app's query is ran.

ProductsupPublisher Incorrect syntax near the keyword 'SET'.                    host        domain\name 7/12/16 12:42 PM
ProductsupPublisher sp_cursoropen/sp_cursorprepare: The statement parameter can only be a batch or a stored procedure with a single select, without FOR BROWSE, COMPUTE BY, or variable assignments.    host        domain\name 7/12/16 12:42 PM
ProductsupPublisher The cursor was not declared.                                    host        domain\name 7/12/16 12:42 PM

And this query

exec sp_cursorfetch 180150003,2,1,100

declare @p3 int
set @p3=-1
declare @p4 int
set @p4=-1
exec sp_cursorfetch 180150003,256,@p3 output,@p4 output
select @p3, @p4

I found this line in \etc\apps\splunk_app_db_connect\local\db_connections.conf and was wondering if the useCursors=true is of concern?

[connection_name]
jdbc:jtds:sqlserver://<host>:<port>/<database>;useCursors=true;domain=<domain_name>;useNTLMv2=true

Beyond this I have found nothing else to indicate the cause of this problem.

0 Karma
1 Solution

chrisduimstra
Path Finder

The cause was unknown, but the issue was solved by switching from jTDS driver to the microsoft driver.

View solution in original post

0 Karma

chrisduimstra
Path Finder

The cause was unknown, but the issue was solved by switching from jTDS driver to the microsoft driver.

0 Karma

amanediel
Explorer

how do you do that?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...