Splunk Search

Exception when running a search in Hunk

Ledion_Bitincka
Splunk Employee
Splunk Employee

I see the following exception in search.log when running a Hunk search against my cluster:

Exception in thread "main" java.lang.NoSuchMethodError: org.codehaus.jackson.map.ObjectMapper.writeValueAsString(Ljava/lang/Object;)Ljava/lang/String;
Tags (1)
0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

This error is caused by older versions of Hadoop distributions shipping with a very old version of Jackson JSON parser. This issue was tracked via HADOOP-7470 and fixed in Hadoop 1.0.1. Therefore if you're using a Hadoop version older than 1.0.1 you are very likely to run into this problem as well. Hadoop 1.0.1 shipped on Feb 2012, and we strongly recommend that you upgrade your deployment to a more recent version.

If upgrading is not an option, then you can fix this issue by following these steps:

  1. download jackson-core-asl-1.8.8.jar and jackson-mapper-asl-1.8.8.jar
  2. place them in a directory in the Hunk server, e.g. /opt/jackson/jars/
  3. add the following config setting to the provider in Hunk (Settings >> Virtual Indexes) or by editing indexes.conf

    vix.splunk.jars = /path/to/jackson/jars/dir/

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

This error is caused by older versions of Hadoop distributions shipping with a very old version of Jackson JSON parser. This issue was tracked via HADOOP-7470 and fixed in Hadoop 1.0.1. Therefore if you're using a Hadoop version older than 1.0.1 you are very likely to run into this problem as well. Hadoop 1.0.1 shipped on Feb 2012, and we strongly recommend that you upgrade your deployment to a more recent version.

If upgrading is not an option, then you can fix this issue by following these steps:

  1. download jackson-core-asl-1.8.8.jar and jackson-mapper-asl-1.8.8.jar
  2. place them in a directory in the Hunk server, e.g. /opt/jackson/jars/
  3. add the following config setting to the provider in Hunk (Settings >> Virtual Indexes) or by editing indexes.conf

    vix.splunk.jars = /path/to/jackson/jars/dir/

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...