Hunk App for HBase: No search result

[maximus_reborn]

I am getting no data when i am putting index=mytable in the search bar.

Please see attachment 'provider_hbase.jpg' for the values of the hbase provider.
Attachment 'hbase_virtual_index.jpg' for the values of the hbase virtual index.
Attachment 'result.jpg' for the values of the results.

If its possible can somebody share a tutorial page for 'Hunk App for HBase'.

[rdagan_splunk]

We added a video tutorial to the app: https://splunkbase.splunk.com/app/3125/

[rdagan_splunk · Accepted solution]

Can you change vix.loglevel = WARN into vix.loglevel = DEBUG ?

At least on my test environment (I am using HDP 2.4 with HBase 1.1.2), when I tried to change vix.zookeeper.znode.parent to have no value, I saw no errors with vix.loglevel = WARN. However, once I changed it to vix.loglevel = DEBUG I saw many errors.

Fixing vix.zookeeper.znode.parent, solved these errors.

[maximus_reborn]

What value did you give in vix.zookeeper.znode.parent? Is it /hbase-unsecure?
In my hadoop configuration i have commented it. Will it not create conflicts?

[rdagan_splunk]

Yes, in my case that was the value (/hbase-unsecure). To verify that that is the actual value, I went to http://:16010/master-status - On the upper right side there is a link to Hbase Configurations (runtime configurations) - I searched for zookeeper.znode.parent

[maximus_reborn]

Thanks it worked.
Finally! some relief. I was not aware about runtime configurations.
Just so you know, my organization will be buying some licences of Splunk in the coming months. We are in the mid of finalizing its usage and involvement in the data pipeline.

Thanks a lot!

[rdagan_splunk]

In addition to the request for the search.log above.
Can you please varify that:
1) The value for zookeeper.znode.parent is empty?
2) The value for vix.hbase.family is cf. Do you have a Column Family called cf?
3) The value for vix.hbase.table is mytable. Do you have a Table called mytable?

[maximus_reborn]

1) The value for zookeeper.znode.parent is empty?
Yes because in my /usr/local/hbase/conf/hbase-site.xml I have commented it. Am i doing something wrong. Please guide. I am using separate zookeeper not the one already in hbase.

2) The value for vix.hbase.family is cf. Do you have a Column Family called cf?
Yes
3) The value for vix.hbase.table is mytable. Do you have a Table called mytable?
Yes. Below is the output when i did list tables.

hbase(main):001:0> list
TABLE
SYSTEM.CATALOG
hbtweet
mytable
pollution_index
pollution_index1
poluution_index1
transactions
tweets
8 row(s) in 0.5080 seconds

hbase(main):002:0> scan 'mytable'
ROW COLUMN+CELL
1 column=cf:create_date, timestamp=1461467563486, value=20150904
1 column=cf:longvalue, timestamp=1461467590603, value=8347365
1 column=cf:value1, timestamp=1461467528375, value=1.65567
1 row(s) in 0.1880 seconds

[maximus_reborn]

Just so you know, I have now added the following properties in the hbase provider in splunk.

vix.hbase.master: saturn:60000
vix.hbase.rootdir: hdfs://saturn:9000/user/hbase
vix.hbase.zookeeper.property.clientPort: 2222
vix.hbase.zookeeper.property.datadir: /usr/local/zookeeper/data

But still it is showing no result found with last lines of search.log as:

04-26-2016 12:15:04.813 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 12:15:04.813 INFO UserManager - Setting user context: admin
04-26-2016 12:15:04.813 INFO UserManager - Done setting user context: NULL -> admin
04-26-2016 12:15:04.813 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 12:15:06.478 ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
04-26-2016 12:15:14.815 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 12:15:24.820 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 12:15:34.824 INFO DispatchThread - Generating results preview took 1 ms

[jruaux_splunk]

Yes a tutorial video is in the works and should be available very soon. In the mean time, would you be able to share your search.log ?

[maximus_reborn]

I wanted to attach the search.log file but it can't be possible in the comments. Here are the last couple of lines of it.

04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'query_time' in stanza [stream:tds]': strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%6NZ")
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'query_time' in stanza [stream:tns]': strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%6NZ")
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'transport' in stanza [stream:udp]': "udp"
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'object_category' in stanza [stream:xmpp]': if(isnotnull(filename), "file", "")
04-26-2016 11:51:06.116 INFO SearchParser - PARSING: typer | tags
04-26-2016 11:51:06.124 INFO FastTyper - found nodes count: comparisons=71, unique_comparisons=44, terms=4, unique_terms=4, phrases=12, unique_phrases=12, total leaves=87
04-26-2016 11:51:06.125 INFO UnifiedSearch - Initialization of search data structures took 9 ms
04-26-2016 11:51:06.125 INFO UnifiedSearch - Processed search targeting arguments
04-26-2016 11:51:06.126 INFO LocalCollector - Final required fields list = _bkt,_cd,_raw,_si,_time,host,index,linecount,source,sourcetype,splunk_server
04-26-2016 11:51:06.126 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 11:51:06.126 INFO UserManager - Setting user context: admin
04-26-2016 11:51:06.126 INFO UserManager - Done setting user context: NULL -> admin
04-26-2016 11:51:06.126 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 11:51:09.446 ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
04-26-2016 11:51:16.128 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:26.131 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:36.136 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:46.139 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:56.143 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:52:06.146 INFO DispatchThread - Generating results preview took 1 ms

Please let me know if anything else is to paste here.

I guess this is just a warning. ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable