Getting Data In

Can we configure multiple IP's in hunk virtual index configuration with the latest Hunk Cassandra Connector?

waltz
Explorer

We have DSE Cassandra v5.0.8 running in multiple node IP's as a cluster setup. And, we have used the datastax provided hunk connector for Cassandra DB to access this data. We were able to configure a single Cassandra node IP in the virtual index configuration when we started using the connector around November last year(It was the latest version available at that time).

Now, we need to set up the configuration in the indexes.conf file or from the UI in such a way that the connector accepts multiple connection points(vix.cassandra.connection.point settings for the virtual index), so that if there is a failure case in one of the nodes, hunk can retrieve the data from the other Cassandra nodes/connection points specified in the virtual indexes configuration. Is this possible in the latest version of the Cassandra connector for hunk? P.S: In the older connector version we are using, we tried giving the multiple node IP's as comma separated values in Vix.cassandra.connection.point field in the configuration settings, but the connection points are not being accepted by hunk. So, Can cluster IP's be provided to conf file in the latest Cassandra Connector versions? If yes, how? Thank you.

0 Karma
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

I do not believe that option is supported. Here is the workaround I used in the past:
[provider:cassandra_erp1]
vix.family = cassandra_erp_family
vix.cassandra.connection.point = host1

[provider:cassandra_erp2]
vix.family = cassandra_erp_family
vix.cassandra.connection.point = host2

[cassandra_video1]
vix.cassandra.cql.cmd = SELECT JSON * FROM videodb.users
vix.cassandra.datetime.field = created_date
vix.cassandra.max.days.hence = 1000
vix.provider = cassandra_erp1

[cassandra_video2]
vix.cassandra.cql.cmd = SELECT JSON * FROM videodb.users
vix.cassandra.datetime.field = created_date
vix.cassandra.max.days.hence = 1000
vix.provider = cassandra_erp2

In the Splunk search I used something like this:
index=cassandra_video1 OR index=cassandra_video2

View solution in original post

rdagan_splunk
Splunk Employee
Splunk Employee

I do not believe that option is supported. Here is the workaround I used in the past:
[provider:cassandra_erp1]
vix.family = cassandra_erp_family
vix.cassandra.connection.point = host1

[provider:cassandra_erp2]
vix.family = cassandra_erp_family
vix.cassandra.connection.point = host2

[cassandra_video1]
vix.cassandra.cql.cmd = SELECT JSON * FROM videodb.users
vix.cassandra.datetime.field = created_date
vix.cassandra.max.days.hence = 1000
vix.provider = cassandra_erp1

[cassandra_video2]
vix.cassandra.cql.cmd = SELECT JSON * FROM videodb.users
vix.cassandra.datetime.field = created_date
vix.cassandra.max.days.hence = 1000
vix.provider = cassandra_erp2

In the Splunk search I used something like this:
index=cassandra_video1 OR index=cassandra_video2

waltz
Explorer

Thank you @rdagan. This approach is nice. But proceeding with this would mean I have to compromise with my search performance, right ? What about latency and how does splunk handle it when, say, host1 is up and host2 is down ?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Yes, doing connection OR connection will make two calls to the Cassandra and will bring double the results. Since Cassandra is fast, using something like index=cassandra_video1 OR index=cassandra_video2 | dedup someid might solve the issue.

Another potential solutions are:
1) Ask Datastax, the owner of the Hunk Cassandra ERP to enable this HA option
2) See if Splunk DB Connect with this JDBC driver to Cassandra has this HA option: https://documentation.progress.com/output/DataDirect/jdbccassandrahelp/#page/cassandrahelp%2Fpassing...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...