Splunk® Supported Add-ons

Splunk Add-on for Oracle Database

Troubleshoot the Splunk Add-on for Oracle Database

General troubleshooting

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Cannot launch add-on

This add-on does not have views and is not intended to be visible in Splunk Web. If you are trying to launch or load views for this add-on and you are experiencing results you do not expect, turn off visibility for the add-on.

For more details about add-on visibility and instructions for turning visibility off, see Check if the add-on is intended to be visible or not in the Splunk Add-ons Troubleshooting topic.

"Literal does not match format string" errors

The input stanza oracle:sysPerf, which uses END_TIME as rising column in tail mode, produces error logs in $SPLUNK_HOME/var/log/splunk/dbx2.log. For example:

04/07/2015 15:12:17 [ERROR] [ws.py] [DBInput Service] ERROR: ORA-01861: literal does not match format string .

04/07/2015 15:12:17 [ERROR] [websocket.py] ERROR: ORA-01861: literal does not match format string

This is a benign side effect from casting and comparing END_TIME as the rising column that does not affect functionality.

For more information, see http://stackoverflow.com/questions/22542882/sql-error-ora-01861-literal-does-not-match-format-string-01861.

Troubleshooting resources

The Splunk Add-on for Oracle Database relies on standard monitor inputs and DB Connect managed inputs on heavy forwarders. For troubleshooting suggestions, refer to these resources:

Troubleshoot Splunk DB Connect: "Troubleshooting" in the Splunk DB Connect manual.

Troubleshoot monitor inputs: http://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs

Troubleshoot forwarder setup: "Troubleshoot the forwarder/receiver connection" in the Forwarding Data manual, part of the Splunk Enterprise documentation.

Multi-line events are not breaking/parsing properly

If you are facing issues in the line breaking or parsing of multi-line events (especially when Oracle Database Server restarts) then add the following parameter under the respective file monitoring input stanza, where {x} is the value of the seconds: time_before_close = {x}

If the issue still persists with a smaller value, increase the value for seconds. For more information, refer to the inputs.conf page in Splunk documentation.

Last modified on 22 April, 2022
Configure Splunk DB Connect v3.8.0 inputs for the Splunk Add-on for Oracle Database   Lookups for the Splunk Add-on for Oracle Database

This documentation applies to the following versions of Splunk® Supported Add-ons: released

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters