I'm having trouble using Tableau to extract data for a Tableau report. I can connect to the saved-search fine by connecting live, but when I try to generate an extract (for Tableau report performance reasons) it gives the error
"internal error starextracttuplesource has wrong number of bindings for number of input columns".
When I look at the fields available in the Tableau DataSource page, it shows the 3 explicit fields I defined in my report search, but also an additional field not present in the search ([MySplunkSavedReport].[_pre_msg]). This is odd for me, as I am able to generate an extract from another saved report, which also includes similar fields (logonuser
(text), usertype
(text), and _time).
Is this related to the known issue identified as DVPL-2957? Any recommendations as to how I can resolve? A somwhat cleaned-up search is below if it is helpful or needed to give context (I can provide more details/clarification if needed).
Thanks in advance to any splunk gurus who can help!
Jeff
host=server* source="WinEventLog:Microsoft-Windows-TerminalServices-SessionBroker/Operational" 801 | rex field=Message "user DOMAINName\\\(?<logonUser>.\w+)" |eval ADAccount=ltrim(logonUser,"DOMAINName\\") | ldapfilter domain=DOMAINName search="(sAMAccountName=$ADAccount$)" attrs="memberOf" | eval userType=case((mvfind(memberOf,"CN\=GRP_Name1") >= 0 ), "Group1", (mvfind(memberOf,"CN\=GRP_Name2") >= 0 ), "Group2", (mvfind(memberOf,"CN\=GRP_Name3") >= 0 ), "Group3") | fields logonUser,userType,_time
Well, not sure what fixed it, but I am no longer getting this error. After updating the Splunk ODBC client on my desktop I restarted my computer, and started fresh with a new Tableau report connecting to the Splunk saved report, and am no longer getting the "wrong number of bindings for number of input columns" error. I wish I could concretely point to what I may have done to resolve....most likely guessing the client update, but can't confirm for sure.
Well, not sure what fixed it, but I am no longer getting this error. After updating the Splunk ODBC client on my desktop I restarted my computer, and started fresh with a new Tableau report connecting to the Splunk saved report, and am no longer getting the "wrong number of bindings for number of input columns" error. I wish I could concretely point to what I may have done to resolve....most likely guessing the client update, but can't confirm for sure.
Edit: Should have added earlier....
We are using Splunk 6.2.2, and I am using Tableau Report Creator 9.0.2 (64-bit) on Windows with Splunk ODBC Connector 1.01
Updated Splunk connector to use ODBC 2.0 64-bit version with same results.