Troubleshoot the Splunk Add-on for Oracle Database¶
General troubleshooting¶
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.
Cannot launch add-on¶
This add-on does not have views and is not intended to be visible in Splunk Web. If you are trying to launch or load views for this add-on and you are experiencing results you do not expect, turn off visibility for the add-on.
For more details about add-on visibility and instructions for turning visibility off, see Check if the add-on is intended to be visible or not in the Splunk Add-ons Troubleshooting topic.
“Literal does not match format string” errors¶
The input stanza oracle:sysPerf, which uses END_TIME as rising column in tail mode, produces error logs in $SPLUNK_HOME/var/log/splunk/dbx2.log. For example:
04/07/2015 15:12:17 [ERROR] [ws.py] [DBInput Service] ERROR: ORA-01861: literal does not match format string .
04/07/2015 15:12:17 [ERROR] [websocket.py] ERROR: ORA-01861: literal does not match format string
This is a benign side effect from casting and comparing END_TIME as the rising column that does not affect functionality.
For more information, see http://stackoverflow.com/questions/22542882/sql-error-ora-01861-literal-does-not-match-format-string-01861.
Troubleshooting resources¶
The Splunk Add-on for Oracle Database relies on standard monitor inputs and DB Connect managed inputs on heavy forwarders. For troubleshooting suggestions, refer to these resources:
Troubleshoot Splunk DB Connect: “Troubleshooting” in the Splunk DB Connect manual.
Troubleshoot monitor inputs: http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs
Troubleshoot forwarder setup: “Troubleshoot the forwarder/receiver connection” in the Forwarding Data manual, part of the Splunk Enterprise documentation.
Multi-line events are not breaking/parsing properly¶
If you are facing issues in the line breaking or parsing of multi-line events (especially when Oracle Database Server restarts) then add the following parameter under the respective file monitoring input stanza, where {x} is the value of the seconds: `time_before_close = {x}`
If the issue still persists with a smaller value, increase the value for seconds. For more information, refer to the inputs.conf page in Splunk documentation.