Troubleshoot the Splunk Add-on for Oracle Database

General troubleshooting

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Cannot launch add-on

This add-on does not have views and is not intended to be visible in Splunk Web. If you are trying to launch or load views for this add-on and you are experiencing results you do not expect, turn off visibility for the add-on.

For more details about add-on visibility and instructions for turning visibility off, see Check if the add-on is intended to be visible or not in the Splunk Add-ons Troubleshooting topic.

"Literal does not match format string" errors

The input stanza oracle:sysPerf, which uses END_TIME as rising column in tail mode, produces error logs in $SPLUNK_HOME/var/log/splunk/dbx2.log. For example:

04/07/2015 15:12:17 [ERROR] [ws.py] [DBInput Service] ERROR: ORA-01861: literal does not match format string .

04/07/2015 15:12:17 [ERROR] [websocket.py] ERROR: ORA-01861: literal does not match format string

This is a benign side effect from casting and comparing END_TIME as the rising column that does not affect functionality.

For more information, see http://stackoverflow.com/questions/22542882/sql-error-ora-01861-literal-does-not-match-format-string-01861.

Troubleshooting resources

The Splunk Add-on for Oracle Database relies on standard monitor inputs and DB Connect managed inputs on heavy forwarders. For troubleshooting suggestions, refer to these resources:

Troubleshoot Splunk DB Connect: "Troubleshooting" in the Splunk DB Connect manual.

Troubleshoot monitor inputs: http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

Troubleshoot forwarder setup: "Troubleshoot the forwarder/receiver connection" in the Forwarding Data manual, part of the Splunk Enterprise documentation.

Multi-line events are not breaking/parsing properly

If you are facing issues in the line breaking or parsing of multi-line events (especially when Oracle Database Server restarts) then add the following parameter under the respective file monitoring input stanza, where {x} is the value of the seconds: time_before_close = {x}

If the issue still persists with a smaller value, increase the value for seconds. For more information, refer to the inputs.conf page in Splunk documentation.