Security

NOT ABLE TO READ FROM ZOOKEEPER SERVER

a12shish
New Member

The Zookeeper servers are Linux instances which are hosted outside Aviva Network, On the other had the sPlunk Search heads are installed on AWS Cloud instances in the Aviva domain.

We established a successful connectivity to the Non-Prod zookeeper servers and were able to index data to Splunk. However when we tried connecting to the Production Zookeeper instance , we started getting the below error. We have confirmed that there is data in the KAFKA Prod servers.

The KAFKA team has confirmed that the sPlunk server has established a connection to the zookeeper however we are not able to read any data from there. We also tried doing a telnet from the Splunk server to Zookeeper host and port and it works successfully.

Error Message Seen :

2/26/18
2:25:57.113 PM
02-26-2018 14:25:57.113 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
host = 10-64-133-150.avivaaws.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
2/26/18
2:25:57.113 PM
02-26-2018 14:25:57.113 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Defaulting to no-operation (NOP) logger implementation
host = 10-64-133-150.avivaaws.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
2/26/18
2:25:57.112 PM
02-26-2018 14:25:57.112 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/kafka_ta/bin/kafka.py" SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
host = 10-64-133-150.avivaaws.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
2/26/18
2:25:50.669 PM
02-26-2018 14:25:50.669 +0000 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/kafka_ta/bin/kafka.py
host = 10-64-133-150.avivaaws.com source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd
2/26/18
2:25:50.664 PM
02-26-2018 14:25:50.664 +0000 INFO IndexWriter - openDatabases complete currentId=1 idx=

connectivity details:-

[root@prodms02 kafka]# netstat -anp|grep 2181|grep '10.64.'
tcp 0 0 10.48.178.195:2181 10.64.139.58:46312 ESTABLISHED 7448/java

kafka server splunk server

Could you please suggest the solution as soon as possible.

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...