Splunk DB Connect V 3.10.0 scheduler failing to run inputs/outputs.

Applicability

Description

Splunk app for DB Connect v3.10.0 has few inputs not being able to run. Connections work fine and there are other inputs under the same connection working absolutely fine. Only few inputs do not work that have the specific characters ( '-' hyphen) in input and output names. It is allowed to save the inputs with hyphen in the name however the scheduler fails to execute them.

 

Investigation

Checked DBX logs with the following SPL:
index=_internal sourcetype=*db* *<inputname that has problems>*

index=_internal sourcetype="*db*" "*WebStats-Login-Attempt-History*"

Following errors are ovsered where the checkpoint for inputs with hyphen in name are not accessible causing the input not to work anymore:

2022-10-13 09:10:53.376 -0500 [dw-42 - PUT /api/inputs/WebStats-Login-Attempt-History] ERROR c.s.d.server.dbinput.task.DbInputCheckpointManager - error loading checkpoint for input title=WebStats-Login-Attempt-History
java.lang.RuntimeException: Can't find checkpoint for DB Input WebStats-Login-Attempt-History
at com.splunk.dbx.server.dbinput.task.DbInputCheckpointManager.lambda$load$0(DbInputCheckpointManager.java:58)

Based on these logs, the python files were analyzed which showed pre-defined regex for specific naming conventions of Inputs and outputs that forbids the use of hyphen in input/output name for DB connect app:
 

 -> DBX_db_input.py

self.modinput_name_regex = re.compile('dbx_db_input://([\w]+)$')

->  Dbx_db_output.py
 

self.modinput_name_regex = re.compile('dbx_db_input://([\w]+)$')self.modinput_name_regex = re.compile('dbx_db_output://([\w]+)$')

This will only extract names matching the regex "\w+" but there is no name convention for this type of stanzas.

For example:  Inputname-test

As per the current functionality, DB Connect only accepts names containing letters, numbers and underscore( _ ).

Resolution

This issue is fixed in the DB Connect app v3.12.2. Please upgrade the DB connect app version in order to use hyphens in the name.

Workaround:

Recommendation:  Update the name of the impacted input /outputs with a name containing just letters, numbers and underscore( _ ).