Splunk Search

Database Query汉字问题

dengjin
New Member

在Database Query中,搜索语句如果包含汉字,则会报错:Error in 'script': Getinfo probe failed for external search command 'dbquery'
搜索语句如下:
select substr(va.CZ,1,10) as time,count(*) as num,count(distinct yh) from LOG va
where va.CZ >= '2013-07-01' and va.CZ <= '2013-07-19' and va.mc = '平台'
group by substr(va.CZ,1,10)
order by substr(va.CZ,1,10) asc

0 Karma

shizl
Engager

When Chinese post to splunkweb, it use GB2312 encode. it should decode to unicode then encode utf-8

please modify the sendEncoded function in bridge.py

def sendEncoded(self, type, data):
    if isinstance(data, unicode):
        enc = unicode(data).encode('utf-8')
    else:  
        enc = data.decode('gb2312').encode('utf-8')
    header = struct.pack('>ci', type, len(enc))
    self.socket.send(header)
    self.socket.send(enc)

This method is not fit for other language encode.

0 Karma

lajiao
New Member

I met the same problem
Splunk 5.0.7 for win2003 sp2 X86(jdk1.7.0_25),DB Connect 1.1.3,oracle

select * from def_ia_user where sta_condition='20131027' and NAME='陈飞'

Getinfo probe failed for external search command 'dbquery'

0 Karma

linu1988
Champion

where are you running this query?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...