Generally Hunk by default will spin up 10 concurrent threads to read files from the Hadoop File System. In the case of Elastic MapReduce this is generally backed by S3. We have noticed that this level of concurrency sometimes creates issues and potential deadlock conditions when reading data from EMR and the s3n filesystem. The quick workaround for this is to minimize the number of concurrent threads reading data from the filesystem using the following setting on the External Results Provider:
vix.splunk.search.mr.threads = 1
This will set the concurrency down to 1 thread and will at least temporarily work around the issue. We are looking into a more permanent fix.
