Processing failures on step 5 of Splunk data source query processing jobs

Products

• Information Centric Analytics

Issue/Introduction

One or more Splunk data source query jobs are failing and returning a 404 error code in the Splunk importer log. The SQL Server Agent indicates job failure with an error code of 170.

Environment

Release : 6.x

Component : Splunk Import Utility

Cause

The job failure is caused by an incorrect Splunk Application Name.

Resolution

Correct the Splunk Application Name field in the failing job's data source query by following this procedure:

1. Open the Risk Fabric console
2. Navigate to Admin > Integration > Data Sources > Choose Data Source | User Defined
3. In the list of User Defined Datasources, locate the data source for the query and job in question
4. Expand the data source name to list the query or queries that use the data source
5. Right-click the query to update and select Edit Query
6. On the Query Details page, locate and update the field Splunk Application Name
7. Click the Save button
8. When prompted to Run Staging Table Creation, click the Yes button

Additional Information

The Splunk importer logs are located in the following path on the server hosting the Risk Fabric Database Utilities:

%ProgramData%\BayDynamics\Logs

The importer log files use the following naming conventions:

IW_SplunkImporter.<yyyyMMdd>.log

SplunkImporter.<yyyyMMdd>.log

SplunkImporterSplunkResultsDriven_<ID>.<yyyyMMdd>.log

Splunk data source query jobs are identified in SQL Server Management Studio (SSMS) under SQL Server Agent > Jobs by the following naming convention:

RiskFabric_IW_DataSourceQueryID_<ID>