Support Questions
Find answers, ask questions, and share your expertise

Hi. I have installed Metron 0.3.0 and have added squid telemetry and enrichment to it. Why am I getting a null when trying to retrieve 'whois' value from 'enrichment' table.

The squid topology has gotten loaded and indexes were getting generated in elasticsearch. However, when I added the squid enrichment config as specified in https://cwiki.apache.org/confluence/display/METRON/Enriching+Telemetry+Events, I am getting an error

o.a.h.h.c.RpcRetryingCaller [INFO] Call exception, tries=34, retries=35, started=592066 ms ago, cancelled=false, msg=row 'hrP��^W�F�^@���`!^@^Ewhois^@ cisco.com' on table 'enrichment' at null

Please suggest how I can correct this. Thankyou

3 REPLIES 3

Rising Star

Hi @Rashmi Varma,

It looks like it's looking for an hbase table that isn't present, specifically for a whois type enrichment, if I'm not mistaken.

Can you supply your configurations?

Thanks!

-D...

Thanks.

You are right. I finally figured it out some days back. I was following the instructions provided to install Metron with an existing HDP cluster. The document does not mention that we need to add topology.classpath custom property to storm configuration as the enrichment topology needs the path to hadoop and hbase configuration for accessing the hbase tables.

This step gets performed automatically by the ambari-install playbook. But it gets left out when we use existing HDP installation.

Thanks once again.

Rising Star

hth,

If you post a link to the doc you followed, I'd be happy to update it.

Thanks!

-D...