[Splunk DB Connect] Splunk DB Connect input failures with "Failed to Load Class" error

Applicability

Description

This article describes a scenario where an input was successfully executed in the Splunk DB Connect UI, and the input was saved without any issues. However, the expected data is not getting collected in the specified index. The article outlines troubleshooting steps to address this issue.

Investigation

During the investigation, it was suspected that the input failure in Splunk DB Connect might be related to a large volume of data. To test this hypothesis, the query was modified to limit the output to 100 columns every minute. However, no data was ingested into Splunk.

Further investigation was carried out by reviewing the logs using the following SPL query:

index=_internal sourcetype=*dbx* host=hostname *input_name*

Upon executing this SPL query, the following error was getting populated in the internal logs:

2025-04-08 05:00:00.818 -0500 Trace-Id=27914300-b045-4624-9dfc-ab891ec85bbf [Scheduled-Job-Executor-99] ERROR i.d.jersey.jackson.JsonProcessingExceptionMapper - Error handling a request: dfe5340583786059 com.fasterxml.jackson.databind.exc.InvalidDefinitionException: Failed to load class 'com.sybase.jdbc42.jdbc.SybSQLException$Access4JacksonSerializer942db545': com.fasterxml.jackson.module.afterburner.ser.BeanPropertyAccessor (through reference chain: org.easybatch.core.job.JobReport["lastError"]) at com.fasterxml.jackson.databind.exc.InvalidDefinitionException.from(InvalidDefinitionException.java:77) at com.fasterxml.jackson.databind.SerializerProvider.reportBadDefinition(SerializerProvider.java:1312) at com.fasterxml.jackson.databind.SerializerProvider._createAndCacheUntypedSerializer(SerializerProvider.java:1459) at com.fasterxml.jackson.databind.SerializerProvider.findPrimaryPropertySerializer(SerializerProvider.java:717) at com.fasterxml.jackson.databind.ser.impl.PropertySerializerMap.findAndAddPrimarySerializer(PropertySerializerMap.java:64) at com.fasterxml.jackson.databind.ser.BeanPropertyWriter._findAndAddDynamic(BeanPropertyWriter.java:901) at com.fasterxml.jackson.module.afterburner.ser.ObjectMethodPropertyWriter.serializeAsField(ObjectMethodPropertyWriter.java:69) at com.fasterxml.jackson.databind.ser.std.BeanSerializerBase.serializeFields(BeanSerializerBase.java:772) at com.fasterxml.jackson.databind.ser.BeanSerializer.serialize(BeanSerializer.java:178) at com.fasterxml.jackson.databind.ser.DefaultSerializerProvider._serialize(DefaultSerializerProvider.java:479) at com.fasterxml.jackson.databind.ser.DefaultSerializerProvider.serializeValue(DefaultSerializerProvider.java:318) at com.fasterxml.jackson.databind.ObjectWriter$Prefetch.serialize(ObjectWriter.java:1572) at com.fasterxml.jackson.databind.ObjectWriter.writeValue(ObjectWriter.java:1061) at com.fasterxml.jackson.jaxrs.base.ProviderBase.writeTo(ProviderBase.java:620) at org.glassfish.jersey.message.internal.WriterInterceptorExecutor$TerminalWriterInterceptor.invokeWriteTo(WriterInterceptorExecutor.java:242) at org.glassfish.jersey.message.internal.WriterInterceptorExecutor$TerminalWriterInterceptor.aroundWriteTo(WriterInterceptorExecutor.java:227) at org.glassfish.jersey.message.internal.WriterInterceptorExecutor.proceed(WriterInterceptorExecutor.java:139) at org.glassfish.jersey.server.internal.JsonWithPaddingInterceptor.aroundWriteTo(JsonWithPaddingInterceptor.java:85) at org.glassfish.jersey.message.internal.WriterInterceptorExecutor.proceed(WriterInterceptorExecutor.java:139) at org.glassfish.jersey.server.internal.MappableExceptionWrapperInterceptor.aroundWriteTo(MappableExceptionWrapperInterceptor.java:61) at org.glassfish.jersey.message.internal.WriterInterceptorExecutor.proceed(WriterInterceptorExecutor.java:139) at org.glassfish.jersey.message.internal.MessageBodyFactory.writeTo(MessageBodyFactory.java:1116) at org.glassfish.jersey.server.ServerRuntime$Responder.writeResponse(ServerRuntime.java:642) at org.glassfish.jersey.server.ServerRuntime$Responder.processResponse(ServerRuntime.java:373) at org.glassfish.jersey.server.ServerRuntime$Responder.process(ServerRuntime.java:363) at org.glassfish.jersey.server.ServerRuntime$AsyncResponder$3.run(ServerRuntime.java:864) at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) at org.glassfish.jersey.internal.Errors.process(Errors.java:292) at org.glassfish.jersey.internal.Errors.process(Errors.java:274) at org.glassfish.jersey.internal.Errors.process(Errors.java:244) at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) at org.glassfish.jersey.server.ServerRuntime$AsyncResponder.resume(ServerRuntime.java:896) at org.glassfish.jersey.server.ServerRuntime$AsyncResponder.resume(ServerRuntime.java:852) at com.splunk.dbx.server.api.resource.InputResource.lambda$runInput$1(InputResource.java:188) at com.splunk.dbx.logging.MdcTaskDecorator.run(MdcTaskDecorator.java:23) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:834)

The error indicates that Splunk DB Connect is unable to load the required JDBC driver, even though the connection was successfully saved without any issues. 

Resolution

To resolve this issue, the connection was reviewed, and it was found that an incorrect driver had been selected, which was causing the failure. 
The appropriate driver was obtained from Splunkbase: https://splunkbase.splunk.com/app/6154

Further installing this driver into the Splunk from the Manage Apps and after the correct driver was selected in the "Connection Configuration" was subsequently updated and saved in the Configuration tab of Splunk DB Connect.

Following this correction, the input was configured using the updated connection and data ingestion into Splunk was confirmed to be successful.