Splunk App for DB Connect - Unable to fetch results using Snowflake JDBC driver from Snowflake Database

Applicability

Description

After attempting to execute a query on Snowflake, but encountered an issue. even after establishing successful connection unable to retrieve the data and resulted in error "java.lang.NoClassDefFoundError"

Investigation

1. Navigate to the DB Connect UI
2. Edit or create new input with snowflake connection
3. Provide necessary details and Execute the SQL Query
   It shows an error as shown below:

"JDBC driver internal error: exception creating result java.lang.NoClassDefFoundError: Could not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil at net.snowflake.client.jdbc.internal.apache.arrow.memory.ArrowBuf.getDirectBuffer(ArrowBuf.java: 234).". 

Run below SPL query to check for given error log,
SPL:

index=_internal *dbx* *snowflake*

ERROR:

error: exception creating result java.lang.NoClassDefFoundError: Could not initialize class net. snowflake.c lient.jdbc.internal.apache.arrow.memory.util.MemoryUtil at net.snowflake.client.jdbc.internal.apache.arrow.memory.ArrowBuf.ge
tDirectBuffer(ArrowBuf.java:234).error: exception creating result java.lang.NoClassDefFo
not initialize class net.snowflake.client.jdbc.internal.apache.arrow.memory.util.MemoryUtil at net.snowflake.
client.jdbc.internal.apache.arrow.memory.ArrowBuf.getDirectBuffer(ArrowBuf.java:234).

Resolution

Snowflake JDBC Driver uses 'Arrow' as a result format while fetching or processing the results of a query sent to Snowflake. The default format was changed from 'JSON' to 'Arrow' a few years back (v3.11.0)
The error is normally encountered on operating systems that are not officially supported and tested for JDBC driver. The underlying cause for the specific error message is that either the Arrow Library is not installed properly or is not supported on the operating system

The first step in fixing the NoClassDefFoundError, is to ensure that the Arrow library is installed properly

If Arrow library installation is not possible or if the Operating System is not supported by Arrow, the next step would be to override the default result format for JDBC by setting the property JDBC_QUERY_RESULT_FORMAT.  The preferred way to set this property would be at session or user level, instead of at account level.

Below ALTER statements can be used to set the property at the account or user level.

ALTER ACCOUNT SET JDBC_QUERY_RESULT_FORMAT='JSON';
ALTER ACCOUNT UNSET JDBC_QUERY_RESULT_FORMAT;  //To revert the changeALTER USER <user_name> SET JDBC_QUERY_RESULT_FORMAT='JSON';
ALTER USER <user_name> UNSET JDBC_QUERY_RESULT_FORMAT;  //To revert the change

The property can be set at the session level, directly inside the java code.  A simple example can be seen in the below code

Statement = connection.createStatement();
Statement.executeQuery("ALTER SESSION SET JDBC_QUERY_RESULT_FORMAT='JSON'");

Related Links

https://community.snowflake.com/s/article/Getting-java-lang-NoClassDefFoundError-for-class-RootAllocator