- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Splunk DB Connect Tail Input command not work...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk DB Connect Tail Input command not working
Hi,
I'm trying to use the Tail command for Splunk DB Connect to pull the newest logs into a Splunk Index. Unfortunately, it is not pulling the data, even when I generate new logs. I have tried the DUMP option which works just fine but duplicates the entire database each dump so I don't want to use it. I have configured the Tail option as noted within the documentation and have used the same configurations as I used with the DUMP option but it still does not work. I am not using any specific SQL query either. What am I doing wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One thing I'm discovering is that the "rising column" and "log date" column names must be specified in ALL CAPS or they won't be recognized. There may be other issues with your particular query as well. I got some insight from checking the $SPLUNK_HOME/var/log/splunk/dbx.log file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's probably correct but after a database restart, it started working. I can't say that I can say what the real solution was though. Which is annoying.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on your errors it looks like your connection to the database is failing. I would suspect that there is a space shortage in the database, probably in regards to the audit trail. The audit trail can't expand, so the login fails, which is why the column doesn't show up in the result set.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well I tried the CAPS option with no results. Though I did check the dbx.log file and found two SQL exceptions. I'm checking with my DBAs but I doubt the database is full. Any other thoughts?
dbx5836:WARN:PooledConnectionFactory - Pooled Connection validation failed: com.splunk.dbx.sql.Database$DatabaseValidationException: Error validating database: java.sql.SQLException: I/O Error: No space left on device
dbx5836:ERROR:TailDatabaseMonitor - Error while executing database monitor: java.sql.SQLException: The column "ERR_ADD_DATE" is not present in the result set
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
