Skip to main content
Self-Service Analytics provides connectors to the following Cloudera data stores:
  • Cloudera Impala is a query engine that accesses data stored in clusters running Apache Hadoop.
  • Cloudera Search enables searches of data stored in Hadoop and provides a simple full-text interface to conduct those searches. Cloudera Search supports Cloudera’s open source Hadoop platform - Cloudera Distributed Hadoop (CDH). Self-Service Analytics also connects to CDH via the HDFS connector .
Cloudera also supports a secure CDH cluster using Kerberos authentication so that access requests can be validated and confirmed. Self-Service Analytics can connect Connect to a Kerberized CDH Cluster.

​
Manage the Impala Connector

The Self-Service Analytics Cloudera Impala™ connector allows you to visualize huge volumes of data stored in their Hadoop cluster in real time and with no ETL. Self-Service Analytics supports Impala versions 3.2 - 3.4. Before you can establish a connection from Self-Service Analytics to Cloudera Impala storage, a connector server needs to be installed and configured. See Manage Connectors and Connector Servers for general instructions and Connect to Impala for details specific to the Cloudera Impala connector. After setting up the connector, create data sources that specify the necessary connection information and identify the data you want to use. See Create and Manage Data Sources for more information. After you set up your data sources, create dashboards, self service reports, and visuals from the data in these data sources. See Create Dashboards. This topic describes: See also:

​
Feature Support

Connector support for specific features is shown in the following table. Key: Y - Supported; N - Not Supported; N/A - not applicable
FeatureSupported?Notes
Admin-Defined FunctionsY
Box PlotsY
Custom SQL QueriesYIf you need to access a BigQuery partition, explicitly include an alias for the built in partition column in your select clause, such as select *, _PARTITIONTIME as pt from projectId.datasetId.tableId.
Derived Fields (Row-Level Expressions)Y
Distinct CountsYCloudera Impala connectors can receive only a single distinct count field in a query.
Fast Distinct ValuesN/A
Group By Multiple FieldsY
Group By TimeY
Group By UNIX TimeY
Histogram Floating Point ValuesY
HistogramsY
Kerberos AuthenticationY
Last ValueY
Live Mode and PlaybackY
Multivalued FieldsN/A
Nested FieldsN/A
PartitionsY
Pushdown Joins for Fusion Data SourcesY
SchemasY
Text SearchN/A
TLSY
User DelegationY
Wildcard FiltersY
Wildcard Filters, Case-Insensitive ModeY
Wildcard Filters, Case-Sensitive ModeY
The Cloudera Impala connector also supports Progress reporting. Progress reporting support allows the connector to report the progress of a running query. On the UI, this shows as Reading nn% in the upper left corner of a visual.

​
Impala Authentication

Support is provided for passing along credentials for users with access privileges to Impala source. Delegation allows for Impala queries to be issued with the privileges from a specified user. This is available in the Connection page and is set as the Do As User list. See Enable User Delegation and Apply User Delegation to a Connection.

​
Connect to Impala

When setting up an Impala connection, you need to provide the following.
  1. Specify the JDBC URL. You can connect to your Impala data source using either simple user credentials authentication or Kerberos authentication with optional SSL encryption. Refer to Connecting to Impala on Kerberized CDH or Connecting to Impala with TLS (SSL) for more details on the configuration. Self-Service Analytics enables you to connect either to a single Impala node or to multiple nodes within a cluster. To connect to a single Impala node, specify a JDBC URL in the following format:
    To connect to multiple Impala nodes, specify the required JDBC URLs separated by commas. The URLs will be used in a round-robin fashion. Keep in mind that such a connection will be valid as long as there is at least one available node. If all the nodes can not be reached, then the connection will not be validated.
  2. If Impala authentication has been set up, provide a user name and password.
  3. To allow for Impala user delegation, select the appropriate custom user attribute from the Do As User drop-down list (set up by the Self-Service Analytics supervisor or administrator). This basically allows Self-Service Analytics to pass along credentials for the specified user with access rights to Impala. See Enable User Delegation and Apply User Delegation to a Connection.
  4. Select Validate. If successfully validated, the connection is saved.

​
Impala Table Settings

Time-based fields can be configured for partitioning in an Impala data source configuration using the Partition column on the Fields tab of the data source. The following options are available:
  • No (partitioning to be done)
  • Date - this option is available for the Time field type. If you select this option, the list of the partitioned columns will be displayed in the Configure column.
  • Function - If you select this option, the list of the partitioned columns and supported MURMUR3_HASH function will be displayed in the Configure column.
Numeric and time-based fields can be edited using the Fields tab:
  • Numeric type Number - ability to select a default aggregation function
  • Time fields - ability to define the default time pattern and granularity; if the time field provides granularities of hour, minute and second, then a time zone label may be applied.
Select the checkbox in the Distinct Count column for any fields if a distinct count is needed. For more information, see Work With Distinct Counts on Cloudera Impala.

​
Work With Distinct Counts on Cloudera Impala

Due to the structure of Cloudera Impala, you cannot build a visual using two or more metrics for which the Distinct Count option has been enabled. You can enable or disable the distinct counts for the specific fields in a data source on the Manage the Fields Work Areas of a data source.

​
Connect to a Kerberized CDH Cluster

A secure CDH Cluster uses Kerberos authentication to validate and confirm access requests. You can set up Self-Service Analytics to connect to the secure CDH Cluster using the instructions provided below. Before establishing a connection to either type of cluster, review the prerequisites and be sure to obtain your Kerberos credentials.

​
Prerequisites

​
Obtain Kerberos Credentials

Each microservice must have its own unique identifier called a principal. Perform the following steps:
  1. Install the Kerberos client on the machine where the Self-Service Analytics Impala connector is installed.
  2. Generate the Kerberos principal and corresponding keytab for the Self-Service Analytics microservice. Before you proceed, make sure that:
    • Self-Service Analytics or a connector is running on a node with proper Kerberos configuration: /etc/krb5.conf or similar location for your Linux distribution.
    • The Kerberos realm on your environment is the same as the realm specified in the kdc.conf file from Impala server.
  3. Check the Kerberos configuration (that is, krb5.conf) and validity of the principal and keytab pair using MIT Kerberos client:
  4. Make the keytab accessible for the Self-Service Analytics server or a connector:

​
Configure an Impala Connector

  1. Create or update the file named /etc/zoomdata/edc-impala.properties. If this file already exists, verify that the information below exists in the file:
  2. Restart the Impala connector:

​
Configure a Cloudera Search Connector

  1. Create or update the file named /etc/zoomdata/edc-cloudera-search.properties. If this file already exists, verify that the information below exists in the file:
  2. Restart the Cloudera Search microservice:

​
Connect to a Kerberized Data Source

You are now ready to create the Cloudera Search or Impala source:
  1. Open a new browser window and log into Self-Service Analytics.
  2. Select Sources.
  3. Select Cloudera Search or Impala.
  4. Specify the name of your source and add a description (if desired). Select Next.
  5. On the Connection tab, define the connection source. You can use an existing connection, if available, or create a new one. To create a new connection, select the Input New Credentials option button and specify the connection name and JDBC URL. Make sure that you enter the JDBC URL in the correct format. For Impala, specify:
    For Cloudera Search, specify:
    The JDBC URL for Cloudera Search needs to be the zookeeper URL of the Kerberized cluster. Replace the placeholders as follows:
    • For <impala_host>, enter the IP address/host name of the Impala node you are connecting to.
    • For <impala_principal@KERBEROS.REALM>, enter the principal of the node you are connecting to. To get the list of all Impala principals, navigate to Cloudera Manager > Administration > Security > Kerberos Credentials.
  6. Select Validate. After successful validation, the values are saved. Select Next.
    If you run into connection issues, verify that the Self-Service Analytics Server was restarted successfully. Access the troubleshooting topic Verify the Self-Service Analytics Server Restart for assistance.
You can continue configuring the data source as needed. After you have completed the configuration, Self-Service Analytics begins accessing the data source using zoomdata_principal@KERBEROS.REALM authenticated by its keytab in /etc/zoomdata/zoomdata_principal.keytab.

​
Use TLS Encryption with Kerberos Authentication

See Connect to Impala with TLS (SSL) Enabled for more details.

​
Enable Data Sharpening for Cloudera Impala Data Sources

Data Sharpening works with certain partitioned Impala data sources. The partitioned field should be a time-based attribute and in a supported time format (for example, yyyy-MM-dd). Follow the steps below to set up Data Sharpening for an Impala data source.
In this release, when your admin enables the Enhanced Experience user interface, you will see changes to workflows you may have used in previous releases.
Configure Data Sharpening for a Cloudera Impala data source configuration:
  1. Log in (either as an administrator or as a user who has been assigned to a group with data source management privileges).
  2. Select the Sources card on your home page or Data Sources from the main menu. The Sources page appears.
  3. Select the appropriate data source configuration to edit it, then access the Fields tab of the data source.
  4. Locate and select the time field you want to use as the driving time field. Select an appropriate time granularity in the Data Details section of the Settings side bar menu, then Save your changes. Consider the 10% rule to ensure Data Sharpening runs when you want it to. See When Data Sharpening Occurs for more information.
  5. Select the Global Settings tab, and enable Time Bar if not enabled to access the data sharpening settings. See Configure Time Bar Defaults.
  6. Select the time field you want to use as the driving time field in the drop-down for Default Time Attribute.
  7. Enable the Prefer Sharpening toggle to enable sharpening and sharpening settings.
  8. Optionally, use the Max Queries slider to specify the maximum number of queries used for Data Sharpening. The default maximum is 10 queries.
  9. When your changes are complete, select Save Settings to save your changes.

​
Connect to Impala with TLS (SSL) Enabled

You can connect to the Impala data source with TLS/SSL network-level encryption to secure your data while working with your data source.

​
Prerequisites

For Impala:
  • Before you proceed, make sure that TLS is configured for Impala using either Cloudera Manager or the Command Line interface.
  • Impala’s TLS configuration requires an x509 certificate that will identify the Impala daemon to clients during TLS connections. Production usage of TLS usually implies purchasing the necessary certificates from a commercial Certificate Authority (CA), while development environments can use self-signed certificates. If you have either a rootCA from the trusted CA or a self-signed certificate in PEM format you can verify your Impala TLS configuration using the openssl utility:
For the Self-Service Analytics Server/Impala Connector:
  • There is no particular configuration related to TLS from the point of view of Self-Service Analytics components. However, the client must have a Java truststore with a correct certificate (for example, a root certificate provided by some CA) installed. This means that the truststore must be accessible to the Self-Service Analytics Server/Impala connector.
  • To list all the certificates installed in the Java truststore, use the keytool utility:
After you have the Java truststore configured, enabling SSL from Self-Service Analytics’s perspective is a matter of composing the correct JDBC URL.

​
Creating a JDBC URL with the TLS Parameters

To specify the TLS-related parameters, use the following template for a JDBC URL:
where:
  • ssl=true is a required parameter for enabling TLS encryption.
  • path_to_truststore is the path to a Java truststore which contains either a certificate issued by a trusted CA or a self-signed certificate (not recommended and shouldn’t be used in a production environment).
    Make sure that the Self-Service Analytics server/connector process has read access privileges to the truststore file.
  • truststore_password is the password to access the truststore.
  • auth=noSasl is a required parameter when no authentication or simple user/password authentication is used.

​
Use TLS Encryption with Kerberos Authentication

See Connect to a Kerberized CDH Cluster for more details on enabling Kerberos authentication. The template for a JDBC URL containing both TLS and Kerberos parameters is as follows:
You do not need to specify the auth=noSasl parameter when using Kerberos authentication.

​
Initial Kerberized Impala Troubleshooting Steps

After configuring Self-Service Analytics to connect to a kerberized Impala data source per Connect to a Kerberized CDH Cluster, Self-Service Analytics may still fail to connect when the user attempts to create a new Impala data source to this kerberized CDH cluster. In these situations, we recommend you to check the following first before opening a support ticket for further assistance:
  • Verify that the time is synchronized between the Kerberos and Self-Service Analytics servers. Kerberos is very sensitive to time differences that exist. If possible, consider configuring a Network Time Protocol (e.g. ntpd) to synchronize the time on your servers.
  • Double-check the configuration parameters, JDBC URL, and that the correct user is specified in the zoomdata.jvm file for Kerberos. For example, an unintended space when copying parameters can cause the connection to fail.
  • Check if you are using AES-256 encryption level in your Active Directory. By default, Java does not support AES-256 encryption. In case your environment is using AES-256 encryption, make sure to do the following whenever you install Self-Service Analytics on a new server or you are upgrading Self-Service Analytics to a new major version:
    1. Navigate to the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 download page.
    2. Download the archive jce_policy-8.zip.
    3. Extract the jce/local_policy.jar and jce/US_export_policy.jar files from the archive to the appropriate directory. Overwrite the files already present in the directory.
      • Linux: /opt/zoomdata/jre/lib/security/
      • Windows: <install-path>/jre/lib/security/
    4. Restart Self-Service Analytics.