No results found, HUNK with MongoDB App installed

[khhenderson]

I have checked my connection from my Hunk server using telnet to the mongo server on port 27017, works fine.
The indexes.conf seems to be setup correctly.

[provider:local-mongodb]
vix.mongodb.host = xxx.xxx.xxx.xxx:27017
vix.command = java
vix.splunk.search.debug = 1


[mongodb_vix]
vix.mongodb.collection = event
vix.mongodb.db = activity
vix.mongodb.auth.mechanism = 
vix.mongodb.auth.password = 
vix.mongodb.auth.username = 
vix.mongodb.field.time = _id
vix.mongodb.field.time.format = objectid

Then I run the following search I get "no results found"

index="mongodb_vix"

Did I miss anything?

[rdagan_splunk]

If you have password enabled MongoDB try:
vix.mongodb.auth.mechanism = CR
vix.mongodb.auth.username = [username]
vix.mongodb.auth.password = [password as plain text]

If your MongoDB does not use any authentication try and remove these vix.mongodb.auth.* flags from your Hunk configuration.

[rdagan_splunk]

I suspect that Cannot consume data with unset stream_type means that you either have a wrong value for the DB (activity) or wrong value for the Collection (event).
Can you validate that you can
Open a MongoDB shell -> type ' use activity ' -> type ' db.event.find() '

[khhenderson]

That seems to work from a shell on the Mongo server.
Do I need to set a "stream_type". Currently the vix.mode is set to stream. Is there a different setting I could try.
Here are the current errors:
11-18-2014 10:19:35.418 ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : null
11-18-2014 10:19:35.443 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-18-2014 10:19:35.444 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

[khhenderson]

Thanks rdagan, I've got the auth and password figured out. Here are my new errors.

11-17-2014 14:08:22.819 ERROR ERP.local-mongodb -  MongoDBERP - Exception while executing search process , Message : null
11-17-2014 14:08:22.823 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 14:08:22.823 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

[rdagan_splunk]

Yes, that is a java version issue.
Try upgrading the version of your Java from 1.6 to 1.7. Once that is done, point vix.command = java to the new location.

[khhenderson]

WOW, Thanks rdagan, making progress.
ERROR ERP.local-mongodb - MongoDBERP - Exception while executing search process , Message : Invalid authentication mechanism for MongoDB
Unsure is it's the mechanism or the user authentication.

[rdagan_splunk]

Try changing the value for Java from vix.command = java
to vix.command = /bin/java
After that search through the search.log to see if you past this java error.

[khhenderson]

Ok, I have new "ERRORS"
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - Exception in thread "main" java.lang.UnsupportedClassVersionError: com/splunk/erp/mongodb/MongoDBERP : Unsupported major.minor version 51.0
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClass1(Native Method)
11-17-2014 11:53:17.467 ERROR ERP.local-mongodb - at java.lang.ClassLoader.defineClassCond(ClassLoader.java:637)
11-17-2014 11:53:17.469 ERROR ERP.local-mongodb - Could not find the main class: com.splunk.erp.mongodb.MongoDBERP. Program will exit.
11-17-2014 11:53:17.472 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 11:53:17.472 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

Not sure if it's the Java version or something with the main index?

[rdagan_splunk]

Do you see any errors in the Splunk search.log file?
' Hunk UI -> Jobs -> Inspect Job -> all the way at the bottom you will see the link to the log file.

[khhenderson]

@rdagan_splunk, Here are the only lines report "ERROR".

11-17-2014 08:37:12.615 ERROR ScriptRunner - Couldn't start child process. script="java -Xmx512m -classpath /opt/hunk/bin/jars/SplunkMR-s6.0-h1.0.jar:/opt/hunk/etc/apps/MongoDBApp/bin/hunk_mongodb_app.jar:/opt/hunk/etc/apps/MongoDBApp/bin/lib/* com.splunk.erp.mongodb.MongoDBERP"
11-17-2014 08:37:12.615 ERROR SearchOperator:stdin - Cannot consume data with unset stream_type
11-17-2014 08:37:12.615 ERROR ExternalResultProvider - Error in 'SearchOperator:stdin': Cannot consume data with unset stream_type

[rdagan_splunk]

if you want we can do a webex session and see if we can find the core of the problem (my email rdagan@splunk.com )