All Apps and Add-ons

Splunk Analytics for Hadoop: kerberos authentication failed


Hi all

I have user on the splunk node and user on hadoop cluster.

I have created keytabfile for and provided in the indexes.conf....and I get this error while executing hadoop commands on splunk host.

ls: Failed on local exception: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]; Host Details : local host is: ""; destination host is: ";

coldPath = $SPLUNK_DB/hadoopidx/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/hadoopidx/db
maxTotalDataSizeMB = 20480
thawedPath = $SPLUNK_DB/hadoopidx/thaweddb

vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-hy2.jar
vix.dfs.namenode.kerberos.principal = hdfs/
vix.env.HADOOP_HOME = /opt/local/hadoop-2.6.0-cdh5.9.1
vix.env.HUNK_THIRDPARTY_JARS = $SPLUNK_HOME/bin/jars/thirdparty/common/avro-1.7.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/avro-mapred-1.7.7.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-compress-1.10.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/commons-io-2.4.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/libfb303-0.9.2.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/parquet-hive-bundle-1.6.0.jar,$SPLUNK_HOME/bin/jars/thirdparty/common/snappy-java-,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-exec-1.2.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-metastore-1.2.1.jar,$SPLUNK_HOME/bin/jars/thirdparty/hive_1_2/hive-serde-1.2.1.jar
vix.env.JAVA_HOME = /usr/java/jdk1.8.0_102 = hadoop = hdfs:// = kerberos = 1 = = = yarn = 0
vix.splunk.home.hdfs = /user/splunkdev/hadoopanalytics/
vix.yarn.nodemanager.principal = yarn/
vix.yarn.resourcemanager.address =
vix.yarn.resourcemanager.principal = yarn/
vix.yarn.resourcemanager.scheduler.address =
vix.mapreduce.jobtracker.kerberos.principal = mapred/
vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab
vix.kerberos.principal = splunkdev@TS.company2.COM

vix.output.buckets.from.indexes = hadoopidx
vix.output.buckets.older.than = 172800
vix.output.buckets.path = /user/splunkdev/splunk_index_archive
vix.provider = eihadoop

0 Karma

Splunk Employee
Splunk Employee

This link may help you debug the message ' Failed to find any Kerberos tgt '

0 Karma


Hi @rdagan,

When I run any job on the Hadoop server it works fine without any issues.

However it fails on the splunk Analytics for Hadoop Server.

I'm quite confused with the kerberos settings in indexes.conf for which I might need some help here:

I have Principal on the splunk analytics node and principal on hadoop cluster. Both these two different accounts with diff passwords.

I was able to run a mapreduce job on the Hadoop cluster using user account.

I generated keytab file (splunkd1.keytab) for on the Splunk node - at /home/splunkd1/ and updated indexes.conf with the same as below:

vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab
vix.kerberos.principal =

Are the steps that I've followed incorrect or correct??
Kindly help.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!