I have checked my connection from my Hunk server using telnet to the mongo server on port 27017, works fine.
The indexes.conf seems to be setup correctly.
[provider:local-mongodb]
vix.mongodb.host = xxx.xxx.xxx.xxx:27017
vix.command = java
vix.splunk.search.debug = 1
[mongodb_vix]
vix.mongodb.collection = event
vix.mongodb.db = activity
vix.mongodb.auth.mechanism =
vix.mongodb.auth.password =
vix.mongodb.auth.username =
vix.mongodb.field.time = _id
vix.mongodb.field.time.format = objectid
Then I run the following search I get "no results found"
index="mongodb_vix"
Did I miss anything?
If you have password enabled MongoDB try:
vix.mongodb.auth.mechanism = CR
vix.mongodb.auth.username = [username]
vix.mongodb.auth.password = [password as plain text]
If your MongoDB does not use any authentication try and remove these vix.mongodb.auth.* flags from your Hunk configuration.
I suspect that Cannot consume data with unset stream_type means that you either have a wrong value for the DB (activity) or wrong value for the Collection (event).
Can you validate that you can
Open a MongoDB shell -> type ' use activity ' -> type ' db.event.find() '
That seems to work from a shell on the Mongo server.
Do I need to set a "stream_type". Currently the vix.mode is set to stream. Is there a different setting I could try.
Here are the current errors:
11-18-2014 10:19:35.418 ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : null
11-18-2014 10:19:35.443 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-18-2014 10:19:35.444 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
Thanks rdagan, I've got the auth and password figured out. Here are my new errors.
11-17-2014 14:08:22.819 ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : null
11-17-2014 14:08:22.823 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 14:08:22.823 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
Yes, that is a java version issue.
Try upgrading the version of your Java from 1.6 to 1.7. Once that is done, point vix.command = java to the new location.
WOW, Thanks rdagan, making progress.
ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : Invalid authentication mechanism for MongoDB
Unsure is it's the mechanism or the user authentication.
Try changing the value for Java from vix.command = java
to vix.command = /bin/java
After that search through the search.log to see if you past this java error.
Ok, I have new "ERRORS"
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/erp/mongodb/MongoDBERP : Unsupported major.minor version 51.0
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClass1(Native Method)
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClassCond(ClassLoader.java:637)
11-17-2014 11:53:17.469 ERROR ERP.local-mongodb - Could not find the main class: com.splunk.erp.mongodb.MongoDBERP. Program will exit.
11-17-2014 11:53:17.472 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 11:53:17.472 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
Not sure if it's the Java version or something with the main index?
Do you see any errors in the Splunk search.log file?
' Hunk UI -> Jobs -> Inspect Job -> all the way at the bottom you will see the link to the log file.
@rdagan_splunk, Here are the only lines report "ERROR".
11-17-2014 08:37:12.615 ERROR ScriptRunner - Couldn't start child process. script="java -Xmx512m -classpath /opt/hunk/bin/jars/SplunkMR-s6.0-h1.0.jar:/opt/hunk/etc/apps/MongoDBApp/bin/hunk_mongodb_app.jar:/opt/hunk/etc/apps/MongoDBApp/bin/lib/* com.splunk.erp.mongodb.MongoDBERP"
11-17-2014 08:37:12.615 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 08:37:12.615 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type
if you want we can do a webex session and see if we can find the core of the problem (my email rdagan@splunk.com )