I personally have not tried .pem, (I just tried it without authentication) but based on this link it looks like you are right: http://api.mongodb.org/python/current/examples/authentication.html ... View more

For Avro just point to the data and if the file extension is .avro you are set. However, If the file extension is different you will need to modify this flag in the provider or VIX vix.splunk.search.recordreader.avro.regex = .avro$ ... View more

MongoDB App allows to specify 4 types of authentication mechanism: 
1) #Authentication mechanism is X509 
 vix.mongodb.auth.mechanism = X509 
 vix.mongodb.auth.username = [username] 

 2) #Authentication mechanism is Kerberos 
 vix.mongodb.auth.mechanism = Kerberos 
vix.mongodb.auth.username = [username] 

 3) #Authentication mechanism is CR 
 vix.mongodb.auth.mechanism = CR 
 vix.mongodb.auth.username = [username] 
 vix.mongodb.auth.password = [password as plain text] 

4) #Authentication mechanism is Plain 
vix.mongodb.auth.mechanism = Plain 
vix.mongodb.auth.username = [username] 
vix.mongodb.auth.source = [source] The value for 'vix.mongodb.auth.mechanism' is case-insensitive. ... View more

It looks like the regex requires a . before the Star (.*) And vix.input.1.lt.offset = 86400 ... View more

My recommendation is for you to add the hadoop connect app to your Hunk install - the app is free and works out of the box with Hunk. This blog has 3 examples of hdfs and lsr that you can use with the app and hunk. http://blogs.splunk.com/2012/12/20/connecting-splunk-and-hadoop/ ... View more

Forgot to add the link to the blog on | hdfs lsr command: http://blogs.splunk.com/2012/12/20/connecting-splunk-and-hadoop/ ... View more

I may have missed the question, but ${SomeKey} already gives you the list of all available Values. So all you need to do in the search is to type index=YourVirtualIndex and you will see all of the Keys and Values on the left side of the search. You can just add these Keys and Values to the Search. You already found the Explore, but if you have the Hadoop Connect app you can also use this hdfs search command: | hdfs lsr ... View more

Have you tried to remove these 3 flags (not authentication flags)? vix.mongodb.auth.mechanism = CR vix.mongodb.auth.password = north123$ vix.mongodb.auth.username = northuser ... View more

There are several customers who are using Splunk to monitor Hadoop. We built a demo App to show how to monitor Hadoop with Yarn or with MR version 1. send me an email [email protected] and I can send you this demo App ... View more

The MongoDB App allows to specify 4 types of authentication mechanism, namely Plain, Kerberos, CR(Challenge–Response) and X509 After you install the App, click on the App main page inside the Hunk UI to see the detail documentation for these options. ... View more

DBQuery commands are free ... View more

DB Connect has 4 options: DB Input = Index the data into a Splunk indexer = you need a Splunk Enterprise license DBX Query = Search your database from the search head = no need for a license DB Lookup = Search your database from the search head = no need for a license DB Output = writes to your database = no need for a license As you can see, DB Connect has no impact on the number of Hadoop nodes ... View more

So far I am aware of only one other customer who is using Hunk to monitor Hadoop. Customer use case = http://www.slideshare.net/Hadoop_Summit/enabling-exploratory-analytics-of-data-in-sharedservice-hadoop-clusters In addition, here is a good blog on the subject: http://blogs.splunk.com/2014/05/14/hunkonhunk/ ... View more

Exactly. After the provider opens a java connection to hadoop, we keep the JVM running until we get all the results or a heartbeat timeout kills the connection. In the case of a provider with MongoDB, we close the connection after the stream from MongoDB gets all the results. ... View more

The JVM behavior is in your control. When Hunk calls MongoDB it requires the MongoDB provider. The provider starts a Java Process to connect and brings the results back to Splunk. The connection to MongoDB is control by the below configuration - you can modify this behavior. vix.command = java vix.command.arg.1 = -Xmx512m vix.command.arg.2 = -classpath vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-s6.0-h1.0.jar:$SPLUNK_HOME/etc/apps/MongoDBApp/bin/hunk_mongodb_app.jar:$SPLUNK_HOME/etc/apps/MongoDBApp/bin/lib/* vix.command.arg.4 = com.splunk.erp.mongodb.MongoDBERP ... View more

Have you tried: Provider 1 -> VIX 1 Provider 2 -> VIX 2 Provider 3 -> VIX 3 Then in the search you you index=VIX* ... View more

I am happy to see that you are able to improve the performance when running Hadoop MapReduce Jobs. The rule is Hunk triggers an MR job if: 1. the search is not ran in verbose mode AND 2. the search contains any filtering predicates in the first search command OR 3. the search contains any reporting commands ... View more

Try this combo: index=idxtmgorc cs_username="anyname" | stats count(cs_username) as username Be in Smart Mode In addition, Here is a link that shows you the Mode options: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutsearchactionsandmodes and a link that shows you the Search commands: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Usethesearchlanguage ... View more

Can you share the Hunk query? Also please make sure you are in a smart search mode (not in Verbose mode) ... View more

1) All the Splunk Ports (8000 - Web, 8089 - Admin, 8065 - App Server, 9997 - TCP Inputs, 8191 - KV Store) Since Hunk is a Hadoop Client node, you will also need to consider these Hadoop ports: 2) All the Hadoop Ports - this is a long list from Cloudera = http://www.cloudera.com/content/cloudera/en/documentation/core/latest/topics/cm_ig_ports.html 2* ) Similar list but from Hortonworks = http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.2.4/bk_HDP_Reference_Guide/content/reference_chap2.html ... View more

Archiving indexers from Splunk to HDFS require the bucket to be in the Warm or Cold stage. Therefore, we can either wait a day, or restart Hunk. The Splunk_Archiver (New App with Hunk 6.2.1) using the Bundle Replication is distributed to all the Indexers.    Every 60 Minutes, the App on each Indexer executes the search = | archivebuckets This command will Triggers bucket copying From the Indexer to HDFS (Similar to Hadoop fs –put BUCKET /HDFS) ... View more

Hunk will run jobs only if you schedule them (will start based on the schedule), report accelerate them (default to every 10 minutes), or if you manually running reports, dashboards, or searches. So, Since you do not see any jobs that are starting from within your Hunk search head (Look for Jobs in the Hunk UI), are there any other Hunk search heads that connects to your Hortonworks cluster? ... View more

In the props.conf do you have your HDFS directory? [source::/user/hunk/data/England/...] sourcetype = England EXTRACT-myField = XYZ ... View more

In Hadoop Connect, don't forget to add the / after 8020 ... View more