Archive

Hunk jobs hang in Amazon Elastic MapReduce

Splunk Employee
Splunk Employee

When I run a search on Hunk against Amazon Elastic MapReduce the searches will run endlessly and never complete giving the full results. How can I fix this?

1 Solution

Splunk Employee
Splunk Employee

Generally Hunk by default will spin up 10 concurrent threads to read files from the Hadoop File System. In the case of Elastic MapReduce this is generally backed by S3. We have noticed that this level of concurrency sometimes creates issues and potential deadlock conditions when reading data from EMR and the s3n filesystem. The quick workaround for this is to minimize the number of concurrent threads reading data from the filesystem using the following setting on the External Results Provider:

vix.splunk.search.mr.threads = 1

This will set the concurrency down to 1 thread and will at least temporarily work around the issue. We are looking into a more permanent fix.

View solution in original post

Splunk Employee
Splunk Employee

Generally Hunk by default will spin up 10 concurrent threads to read files from the Hadoop File System. In the case of Elastic MapReduce this is generally backed by S3. We have noticed that this level of concurrency sometimes creates issues and potential deadlock conditions when reading data from EMR and the s3n filesystem. The quick workaround for this is to minimize the number of concurrent threads reading data from the filesystem using the following setting on the External Results Provider:

vix.splunk.search.mr.threads = 1

This will set the concurrency down to 1 thread and will at least temporarily work around the issue. We are looking into a more permanent fix.

View solution in original post