All Apps and Add-ons

Hunk jobs hang in Amazon Elastic MapReduce

csharp_splunk
Splunk Employee
Splunk Employee

When I run a search on Hunk against Amazon Elastic MapReduce the searches will run endlessly and never complete giving the full results. How can I fix this?

1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

Generally Hunk by default will spin up 10 concurrent threads to read files from the Hadoop File System. In the case of Elastic MapReduce this is generally backed by S3. We have noticed that this level of concurrency sometimes creates issues and potential deadlock conditions when reading data from EMR and the s3n filesystem. The quick workaround for this is to minimize the number of concurrent threads reading data from the filesystem using the following setting on the External Results Provider:

vix.splunk.search.mr.threads = 1

This will set the concurrency down to 1 thread and will at least temporarily work around the issue. We are looking into a more permanent fix.

View solution in original post

csharp_splunk
Splunk Employee
Splunk Employee

Generally Hunk by default will spin up 10 concurrent threads to read files from the Hadoop File System. In the case of Elastic MapReduce this is generally backed by S3. We have noticed that this level of concurrency sometimes creates issues and potential deadlock conditions when reading data from EMR and the s3n filesystem. The quick workaround for this is to minimize the number of concurrent threads reading data from the filesystem using the following setting on the External Results Provider:

vix.splunk.search.mr.threads = 1

This will set the concurrency down to 1 thread and will at least temporarily work around the issue. We are looking into a more permanent fix.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...