Connecting Splunk to Hadoop or other data platforms ?

[tabkha]

What is the best practice in terms of connecting Splunk to Hadoop or other data platforms, is data virtualization a solution ? Do solutions like Presto allow data to be linked between Splunk and Hadoop ? or is the only way to get the connection working to use a connect application for the Hadoop hdd data.

[rdagan_splunk]

The recommended way to read data from Hadoop to Splunk is to use Splunk Analytics for Hadoop: https://docs.splunk.com/Documentation/Splunk/latest/HadoopAnalytics/MeetSplunkAnalyticsforHadoop
The recommended way to write data from Splunk to Hadoop is to use Splunk Hadoop Data Roll: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingindexestoHadoop

If you want to use Presto, our recommendation is to use Splunk DB Connect (https://docs.splunk.com/Documentation/DBX) with Presto JDBC driver (for example, the JDBC found here https://prestodb.github.io/docs/current/installation/jdbc.html )