All Apps and Add-ons

Hunk App for HBase: No search result

maximus_reborn
Path Finder

I am getting no data when i am putting index=mytable in the search bar.

Please see attachment 'provider_hbase.jpg' for the values of the hbase provider.
Attachment 'hbase_virtual_index.jpg' for the values of the hbase virtual index.
Attachment 'result.jpg' for the values of the results.

If its possible can somebody share a tutorial page for 'Hunk App for HBase'.

0 Karma
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

Can you change vix.loglevel = WARN into vix.loglevel = DEBUG ?

At least on my test environment (I am using HDP 2.4 with HBase 1.1.2), when I tried to change vix.zookeeper.znode.parent to have no value, I saw no errors with vix.loglevel = WARN. However, once I changed it to vix.loglevel = DEBUG I saw many errors.

Fixing vix.zookeeper.znode.parent, solved these errors.

View solution in original post

rdagan_splunk
Splunk Employee
Splunk Employee

We added a video tutorial to the app: https://splunkbase.splunk.com/app/3125/

rdagan_splunk
Splunk Employee
Splunk Employee

Can you change vix.loglevel = WARN into vix.loglevel = DEBUG ?

At least on my test environment (I am using HDP 2.4 with HBase 1.1.2), when I tried to change vix.zookeeper.znode.parent to have no value, I saw no errors with vix.loglevel = WARN. However, once I changed it to vix.loglevel = DEBUG I saw many errors.

Fixing vix.zookeeper.znode.parent, solved these errors.

maximus_reborn
Path Finder

What value did you give in vix.zookeeper.znode.parent? Is it /hbase-unsecure?
In my hadoop configuration i have commented it. Will it not create conflicts?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Yes, in my case that was the value (/hbase-unsecure). To verify that that is the actual value, I went to http://:16010/master-status - On the upper right side there is a link to Hbase Configurations (runtime configurations) - I searched for zookeeper.znode.parent

maximus_reborn
Path Finder

Thanks it worked.
Finally! some relief. I was not aware about runtime configurations.
Just so you know, my organization will be buying some licences of Splunk in the coming months. We are in the mid of finalizing its usage and involvement in the data pipeline.

Thanks a lot!

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

In addition to the request for the search.log above.
Can you please varify that:
1) The value for zookeeper.znode.parent is empty?
2) The value for vix.hbase.family is cf. Do you have a Column Family called cf?
3) The value for vix.hbase.table is mytable. Do you have a Table called mytable?

0 Karma

maximus_reborn
Path Finder

1) The value for zookeeper.znode.parent is empty?
Yes because in my /usr/local/hbase/conf/hbase-site.xml I have commented it. Am i doing something wrong. Please guide. I am using separate zookeeper not the one already in hbase.

2) The value for vix.hbase.family is cf. Do you have a Column Family called cf?
Yes
3) The value for vix.hbase.table is mytable. Do you have a Table called mytable?
Yes. Below is the output when i did list tables.

hbase(main):001:0> list
TABLE
SYSTEM.CATALOG
hbtweet
mytable
pollution_index
pollution_index1
poluution_index1
transactions
tweets
8 row(s) in 0.5080 seconds

hbase(main):002:0> scan 'mytable'
ROW COLUMN+CELL
1 column=cf:create_date, timestamp=1461467563486, value=20150904
1 column=cf:longvalue, timestamp=1461467590603, value=8347365
1 column=cf:value1, timestamp=1461467528375, value=1.65567
1 row(s) in 0.1880 seconds

0 Karma

maximus_reborn
Path Finder

Just so you know, I have now added the following properties in the hbase provider in splunk.

vix.hbase.master: saturn:60000
vix.hbase.rootdir: hdfs://saturn:9000/user/hbase
vix.hbase.zookeeper.property.clientPort: 2222
vix.hbase.zookeeper.property.datadir: /usr/local/zookeeper/data

But still it is showing no result found with last lines of search.log as:

04-26-2016 12:15:04.813 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 12:15:04.813 INFO UserManager - Setting user context: admin
04-26-2016 12:15:04.813 INFO UserManager - Done setting user context: NULL -> admin
04-26-2016 12:15:04.813 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 12:15:06.478 ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
04-26-2016 12:15:14.815 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 12:15:24.820 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 12:15:34.824 INFO DispatchThread - Generating results preview took 1 ms

0 Karma

jruaux_splunk
Splunk Employee
Splunk Employee

Yes a tutorial video is in the works and should be available very soon. In the mean time, would you be able to share your search.log ?

0 Karma

maximus_reborn
Path Finder

I wanted to attach the search.log file but it can't be possible in the comments. Here are the last couple of lines of it.

04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'query_time' in stanza [stream:tds]': strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%6NZ")
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'query_time' in stanza [stream:tns]': strptime(timestamp, "%Y-%m-%dT%H:%M:%S.%6NZ")
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'transport' in stanza [stream:udp]': "udp"
04-26-2016 11:51:06.104 INFO CalcFieldProcessor - Found valid eval expression for field 'object_category' in stanza [stream:xmpp]': if(isnotnull(filename), "file", "")
04-26-2016 11:51:06.116 INFO SearchParser - PARSING: typer | tags
04-26-2016 11:51:06.124 INFO FastTyper - found nodes count: comparisons=71, unique_comparisons=44, terms=4, unique_terms=4, phrases=12, unique_phrases=12, total leaves=87
04-26-2016 11:51:06.125 INFO UnifiedSearch - Initialization of search data structures took 9 ms
04-26-2016 11:51:06.125 INFO UnifiedSearch - Processed search targeting arguments
04-26-2016 11:51:06.126 INFO LocalCollector - Final required fields list = _bkt,_cd,_raw,_si,_time,host,index,linecount,source,sourcetype,splunk_server
04-26-2016 11:51:06.126 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 11:51:06.126 INFO UserManager - Setting user context: admin
04-26-2016 11:51:06.126 INFO UserManager - Done setting user context: NULL -> admin
04-26-2016 11:51:06.126 INFO UserManager - Unwound user context: admin -> NULL
04-26-2016 11:51:09.446 ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable
04-26-2016 11:51:16.128 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:26.131 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:36.136 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:46.139 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:51:56.143 INFO DispatchThread - Generating results preview took 1 ms
04-26-2016 11:52:06.146 INFO DispatchThread - Generating results preview took 1 ms

Please let me know if anything else is to paste here.

I guess this is just a warning. ERROR ERP.hbase - Unable to load native-hadoop library for your platform... using builtin-java classes where applicable

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...