Splunk Search

"Exception - com.splunk.mr.JobStartException: Failed to start MapReduce job."

dannili
Communicator

I just moved my whole dashboard to production environment but when I tried to test using a search string, following exception and error occur:

2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.   
•[hdfsprovider] Error while running external process, return_code=255. See search.log for more info 
•[hdfsprovider] Exception - com.splunk.mr.JobStartException: Failed to start MapReduce job. Please consult search.log for more information. Message: Failed to create Hunk directories due to permission denied. Please make sure you have write permission to the directory specified by vix.splunk.home.hdfs in your provider 

**********Search

 index="my_index" | stats count(eval( OverallAvgNetworkMOS < 3.5 OR Stream_1_JitterInterArrival > 30 OR Stream_2_JitterInterArrival > 30 OR Stream_1_RoundTrip > 500 OR Stream_2_RoundTrip > 500 OR Stream_1_PacketLossRate>0.1 OR Stream_2_PacketLossRate>0.1)) AS bad_call count(eval(OverallAvgNetworkMOS >= 3.5)) AS good_call | transpose

I checked other posts related to error but could not find a suitable solution. Is this knida search related to config?

Does anyone know how these two can happen? How do I fix this? Thanks a lot!

0 Karma
1 Solution

mwdbhyat
Builder

Are you using Hunk ? To me it looks like its a permissions issue with virtual index - check this out https://docs.splunk.com/Documentation/Hunk/6.4.10/Hunk/Setupavirtualindex

Have you checked search.log ?

Does it only do it when you run that specific search, or any search ?

Are your DEV and PROD environments using the same architecture/setup ?

View solution in original post

0 Karma

mwdbhyat
Builder

Are you using Hunk ? To me it looks like its a permissions issue with virtual index - check this out https://docs.splunk.com/Documentation/Hunk/6.4.10/Hunk/Setupavirtualindex

Have you checked search.log ?

Does it only do it when you run that specific search, or any search ?

Are your DEV and PROD environments using the same architecture/setup ?

0 Karma

dannili
Communicator

thanks for ur response. Turns out it's the setup issue. System team helped fix it.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...