Getting error "Error in 'dbxquery' command: External search command exited unexpectedly with nonzero error code 1." while executing DB Input.

Applicability

Description

Investigation

The following error appears while executing a SQL query while creating or with existing input.

" Error in 'dbxquery' command: External search command exited unexpectedly with nonzero error code 1."

The older version code ( commands.conf ) has Java compatibility but the latest version has Python compatibility, so when the app gets upgraded from an older to a newer version, Java is defined on the settings for commands.conf 
Splunk takes precedence over the local folder.

Resolution

1. When upgrading to 3.2.0 or above 
Remove the commands.conf file from the local folder to fix the issue.

2. When using 3.9.0 or above
Follow the following steps to fix the issue, for DB connect recent versions, a glitch has been identified wherein a query is not getting executed on Python. Workaround:

• In dbapp-directory>/default/commands.conf Copy [dbxquery] stanza as below and paste it under local folder > commands.conf (Create the file if doesn't exist )
• Uncomment all the parameters of [dbxquery] stanza
• Restart Splunk
• Execute the query, it should work.

####### uncomment following lines to revert dbxquery to 3.2.0 version
# [dbxquery]
# run_in_preview = false
# filename = java.path
# chunked = true
# command.arg.1 = -Dlogback.configurationFile=../config/command_logback.xml
# command.arg.2 = -DDBX_COMMAND_LOG_LEVEL=INFO
# command.arg.3 = -cp
# command.arg.4 = ../jars/dbxquery.jar
# command.arg.5 = com.splunk.dbx.command.DbxQueryCommand