Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

While running Apache NiFi and using its PutSplunk processor. Its saying..... consider changing the Operating System's maximum receive buffer

avatar
Rising Star

12756-putsplunk-session-issue.png

When I Cleared whole queue and tried again. Now again its saying something similar, ArrayIndexOutOfBounds exception
1 ACCEPTED SOLUTION

avatar
Rising Star

Thanks @Bryan Bende @Timothy Spann, @ozhurakousky foryour reply.

It was some configuration issue.

While trying to put file into Splunk, I was using web-port (8081 in my case) of splunk in configuration of PutSplunk. When I pointed my PutSplunk configuration to TCP port of Splunk(In Splunk setting go to Data Inputs -> Click on TCP and enter details as instructed to create a new TCP input port of Splunk) it started working properly.

View solution in original post

6 REPLIES 6

avatar
Contributor

Pradhuman

Would you mind provide more information such as full stack trace etc. It's nearly impossible to diagnose the issue with information provided.

Thanks

Oleg

avatar
Rising Star

@ozhurakousky

Yeah sure. I have uploaded the image now.

avatar
Contributor

The exception messages and error reporting you see above probably needs to be reviewed and polished as they are inconclusive and not informative. Could you please look at the logs and post the stack trace related to the above.

avatar
Master Guru

Can you post the specifications for the NiFi server? Is this running on Windows? Is this installed via ambari or just nifi unzip? Did you increase the JVM memory via conf/?

Can you access your splunk on that PC via other means?

Sometimes you just need to let it connect and it will start sending in after a few minutes.

Is there a firewall blocking access?

avatar
Master Guru

The message about changing the OS buffer is just a warning and not something to usually something to worry about it. What is happening is that there is a connection pool, and each time a connection is made it tries to set the socket send buffer based on the value of the property in the processor, and if it can't set it to that value than it logs a warning to let you know.

The latest screenshot you posted is a completely different problem, and it is something we need to look into. What I think is happening is that the processor is holding on to flow files to transfer them in the next execution, but since you cleared the queue they are no longer valid and this is causing an unexpected situation. As Oleg mentioned, we need to see the full stacktrace from the logs for this.

avatar
Rising Star

Thanks @Bryan Bende @Timothy Spann, @ozhurakousky foryour reply.

It was some configuration issue.

While trying to put file into Splunk, I was using web-port (8081 in my case) of splunk in configuration of PutSplunk. When I pointed my PutSplunk configuration to TCP port of Splunk(In Splunk setting go to Data Inputs -> Click on TCP and enter details as instructed to create a new TCP input port of Splunk) it started working properly.