This didn't work... ... View more

Would it work to replace the Universal Forwarder with a new one? ... View more

My team was able to get this to work through the backend, too. Another thing to add here is that I kept getting this error when my SQL query started with "EXEC." When I asked the user for a query that started with "SELECT" because most of our other queries start with that, I stopped getting the error and it worked. I do not know enough about SQL to speak to the significance of this difference, but this is the behavior we are seeing. Splunk seems to take EXEC on the backend but not in the UI, and SELECT in the UI works. ... View more

This worked for me too. ... View more