Can Hunk store processed search results ?

[gauravmishra15]

Hi,

We are looking forward to setup Hunk in our IT environment for Log Collection and trend analysis. However (as expected) data volume and velocity is high. We are looking for a way to run Hunk interactive search queries from RAW data and store the processed results in NoSQL Database.

Is it possible for Hunk to store the search results on to a Database (Preferably NoSQL) ? Please suggest the best way to store processed search results.

Gaurav

[rdagan_splunk]

By Append I assume the option to Insert new record to the DB = Yes insert or free form SQL is supported.

[gauravmishra15]

Thanks ! This is very good explanation, I appreciate your help.

Is there any way to use dboutput command to append existing table ?

[rdagan_splunk · Accepted solution]

To store the processed results we normally recommend Hunk Report Acceleration. This option store the results back into HDFS and keep it fresh all the time.
http://docs.splunk.com/Documentation/Hunk/latest/Hunk/Workwithreportacceleration

However, if you want to use RDBMS or NoSQL to store the results you will need to use Hunk with the DB Connect App -> DBOutput command
http://docs.splunk.com/Documentation/DBX/1.1.6/DeployDBX/Commands#dboutput