All Apps and Add-ons

How do I do Job orchestration between Splunk and Hadoop?

gurugv
Engager

My data primarily resides on Hadoop. I want to use Splunk for basic computations/ correlations, e.g : Aggregations / Sessionization and push the data back to Hadoop, where there would be further more complicated business logic applied on top of the moved data and the result stored back in Hadoop, which will eventually get indexed back in Splunk for query / reporting purpose.

To reliably do this, I need some orchestration of the sequence of these activities. E.g : (1) For a specific time segment, trigger the Report Acceleration/Summary Index. (2) Move the data to Hadoop (3) Run the MR job on the new data. (4) Index the result in Splunk.

Is their some oozie sort of integration with splunk that will let me orchestrate between splunk and hadoop jobs?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Splunk currently does not have such correlations.
However, you may want to try:
Hadoop Connect Export (move your results to Hadoop)
Hadoop Connect Import (index the enriched - after more MR Jobs - back into Splunk)
or
Hunk VIX pushing the results back from HDFS into Summary Index.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...