To monitor Apache Hadoop clusters with Splunk Enterprise 6 or later versions, you can follow these steps: Configure data ingestion: Use the Hadoop Connect feature in Splunk Enterprise to collect data from the Hadoop cluster. This feature allows you to ingest data from various sources, including Hadoop Distributed File System (HDFS), YARN, MapReduce, and Hive1. Set up Hadoop monitoring inputs: Configure Splunk to monitor the Hadoop cluster by specifying the relevant log files and metrics to collect. You can use the Hadoop App for Splunk, which provides pre-configured inputs and dashboards specifically designed for monitoring Hadoop clusters1. Monitor performance and troubleshoot issues: Leverage the monitoring capabilities of Splunk Enterprise to gain insights into the performance of your Hadoop cluster. Use the pre-built dashboards and reports to visualize and analyze various metrics, such as resource utilization, job status, data ingestion rates, and error logs. This allows you to identify bottlenecks, troubleshoot issues, and optimize the cluster performance1. Set up alerts and notifications: Configure alerts in Splunk Enterprise to receive real-time notifications when specific events or conditions occur in the Hadoop cluster. This enables you to proactively address issues and ensure the smooth operation of the cluster1. By following these steps, you can effectively monitor Apache Hadoop clusters using Splunk Enterprise 6 or later versions. For more detailed instructions and best practices, you can refer to the Splunk community forum, where users have discussed how to monitor Hadoop with Splunk1. Hope this helps! For more details visit our website: https://www.strongboxit.com ... View more

i am new to hadoop, so from what I understood: If your data upload is not an actual service of the cluster, which should be running on an edge node of the cluster, then you can configure your own computer to work as an edge node. An edge node doesn't need to be known by the cluster (but for security stuff) as it does not store data nor compute job. This is basically what it means to be an edge-node: it is connected to the hadoop cluster but does not participate. In case it can help someone, here is what I have done to connect to a cluster that I don't administer: get an account on the cluster, say myaccount create an account on you computer with the same name: myaccount configure your computer to access the cluster machines (ssh w\out passphrase, registered ip, ...) get the hadoop configuration files from an edge-node of the cluster get a hadoop distrib (eg. from here) uncompress it where you want, say /home/myaccount/hadoop-x.x add the following environment variables: JAVA_HOME, HADOOP_HOME (/home/me/hadoop-x.x) (if you'd like) add hadoop bin to your path: export PATH=$HADOOP_HOME/bin:$PATH replace your hadoop configuration files by those you got from the edge node. With hadoop 2.5.2, it is the folder $HADOOP_HOME/etc/hadoop also, I had to change the value of a couple $JAVA_HOME defined in conf files. To find them use: grep -r "export.*JAVA_HOME" Then do hadoop fs -ls / which should list the root directory of the cluster hdfs. KBS Training ... View more

The Cloudera specific log location should be here: ### Cloudera Yarn Log Files [monitor:///var/log/hadoop-yarn/*nodemanager*] sourcetype = hadoop_nodemanager index = hadoopmon_metrics [monitor:///var/log/hadoop-yarn/*resourcemanager*] sourcetype = hadoop_resourcemanager index = hadoopmon_metrics [monitor:///var/log/hadoop-yarn/*proxyserver*] sourcetype = hadoop_proxyserver index = hadoopmon_metrics [monitor:///var/log/hadoop-mapreduce/*historyserver*] sourcetype = hadoop_historyserver index = hadoopmon_metric ### Cloudera Hadoop Log Files [monitor:///var/log/hadoop-hdfs/*datanode*] sourcetype = hadoop_datanode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*namenode*] sourcetype = hadoop_namenode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*secondarynamenode*] sourcetype = hadoop_secndarynamenode index = hadoopmon_metrics [monitor:///var/log/hadoop-hdfs/*journalnode*] sourcetype = hadoop_journalnode index = hadoopmon_metrics ### Cloudera Configuration Files [monitor:///etc/hadoop/conf/*] crcSalt = <SOURCE> disabled = 0 sourcetype = hadoop_global_conf index = hadoopmon_configs And after you collect the logs you can run searches similar to these: [Yarn All Applications] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | eval elapsed_time = finishTime - startTime | table appId name user queue finalStatus elapsed_time [Yarn Top User] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | top user [Yarn Success Rate] index=hadoopmon_metrics sourcetype=hadoop_resourcemanager appId=* | top finalStatus ... View more

Hi, Were you able to get Kerberos authentication working with Splunk DB connect? I am stuck on similar issue and using DB Connect 3.2. I already have setup db_connection_types.conf and added Cloudera driver file HiveJDBC41.jar under $SPLUNK_HOME/etc/apps/splunk_app_db_connect/drivers ... View more

Hi, yes I got it to work. Try: Name Node = maprfs:///  Since MapR use Yarn the important flags are  vix.yarn.resourcemanager.address vix.yarn.resourcemanager.scheduler.address ... View more

Hi - did you manage to solve the issue ? I am also stuck in a similar situation ... View more

Yep, thanks. ... View more

Splunk Hadoop Data Roll can backup your indexes into HDFS or S3 (we recommend that you use S3A and not S3). Here are few links that can help: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop https://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/ArchivingSplunkindexestoS3 https://answers.splunk.com/search.html?f=&redirect=search%2Fsearch&sort=relevance&q=s3a&type=question https://www.splunk.com/blog/2015/02/11/faster-and-limitless-hunk-archiving-to-s3-with-hadoop-2-6-0.html ... View more

Let me know and we can try to debug these issues? My email is rdagan@splunk.com ... View more

The recommended way to read data from Hadoop to Splunk is to use Splunk Analytics for Hadoop: https://docs.splunk.com/Documentation/Splunk/latest/HadoopAnalytics/MeetSplunkAnalyticsforHadoop The recommended way to write data from Splunk to Hadoop is to use Splunk Hadoop Data Roll: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop If you want to use Presto, our recommendation is to use Splunk DB Connect (https://docs.splunk.com/Documentation/DBX) with Presto JDBC driver (for example, the JDBC found here https://prestodb.github.io/docs/current/installation/jdbc.html ) ... View more

I've been running into exactly the same issues - did you ever get this resolved? ... View more

By default I see ' user ' + 3 capabilities [root@localhost default]# pwd /opt/splunk/etc/apps/HadoopConnect/default [root@localhost default]# more authorize.conf [capability::hc_read] [capability::hc_write] [role_hc_admin] importRoles = user hc_read = enabled hc_write = enabled schedule_search = enabled ... View more

Thanks @rdagan_splunk! The setting I think I was looking for was vix.fs.s3a.endpoint = http://127.0.0.1:9000 . It's not something that is listed in the Per Virtual Provider/Index settings of indexes.conf.spec. Doing some research I found it can be set in hdfs-site.xml in your $HADOOP_HOME/etc/hadoop as well. ... View more

As you noticed Hadoop Connect export can only use index time and not event time. Therefore, I would recommend you modify your search to try and use the flags _index_earliest and _index_latest For example, index=data_index_to_export _index_earliest=-7h@h _index_latest=-6h@h This link maybe helpful: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Searchtimemodifiers ... View more

As you can see from this video ( https://www.youtube.com/watch?v=TmYHsabpk_Q ) When you setup the Java path and Hadoop path inside Splunk Hadoop Connect, you should not include the ' bin/hadoop or bin/java part Can you share the output of these ' which hadoop ' and ' which java ' commands? ... View more

How about the product Splunk Analytics for Hadoop? Is that product also has org restrictions? https://www.splunk.com/en_us/products/apps-and-add-ons/splunk-analytics-for-hadoop.html ... View more

If your license is Splunk Analytics for Hadoop (Hunk), the UI will show Hunk. ... View more

It sounds like the right App is actually the Hadoop Monitoring: Hadoop monitoring – Read Hadoop logs and monitor Hadoop health and jobs ( https://splunkbase.splunk.com/app/3134/ ) Hadoop Data Roll - sends raw data from Splunk buckets to Hadoop Splunk Analytics for Hadoop (Hunk) - Generate MapReduce Jobs to read data from HDFS Splunk Hadoop Connect Export - Send results from Splunk SH to HDFS Splunk Hadoop Connect Import - Read files from HDFS and Index them in Splunk ... View more

The process should be something along the lines of: 1) package your local app tar cvzf my_hadoopconnect.tgz /splunk/etc/apps/HadoopConnect 2) untar in your dev tar xvzf my_hadoopconnect.tgz -C /splunk/etc/apps/HadoopConnect 3) restart splunk /splunk/bin/splunk restart Here are the steps: http://docs.splunk.com/Documentation/HadoopConnect/1.2.5/DeployHadoopConnect/Downloadandinstalltheapp#Install_the_app_on_a_full_Splunk_instance ... View more

Thank you Rdagan! ... View more

Thank you @rdagan. Sure, I will contact my Splunk sales team for the request. ... View more

I would recommend you start by downloading the java or python source codes for this sample app: https://splunkbase.splunk.com/app/1802/ ... View more

Hi @rdagan, I got my answer. I want to getting data from within the database. So , as far I understand from your above mentioned answer that I should use Hunk app for this purpose. Thanks @rdagan_splunk 🙂 ... View more