topic Re: Splunk Stream question in Splunk Search

Splunk Stream question

chaker — Tue, 08 Dec 2015 20:15:30 GMT

I work for energy capture and storage organisation and we were thinking of using Splunk to capture data from our main "Ecto-Containment System". Streams are a key component of our workflow and one of our reps, Spengler, said we shouldn't cross the streams.

I was just curious what happens if you cross the streams?

Re: Splunk Stream question

dokian — Tue, 08 Dec 2015 20:18:27 GMT

It would be bad.

Try to imagine all indexing as you know it stopping instantaneously and every bucket in your indexes exploding at the speed of an accelerated data model.

Re: Splunk Stream question

ppablo — Tue, 08 Dec 2015 20:26:56 GMT

Hi @chaker

To clarify for other users, but are you referring to the Splunk App for Stream? https://splunkbase.splunk.com/app/1809/ You didn't mention it anywhere in your post.

Re: Splunk Stream question

piebob — Tue, 08 Dec 2015 20:54:19 GMT

Re: Splunk Stream question

woodcock — Wed, 09 Dec 2015 08:47:37 GMT

If you are using Flash for your Indexers, then you will crush all the bugs:

http://www.hitfix.com/whats-alan-watching/review-the-flash-revenge-of-the-rogues-heat-wave-vs-captain-cold