Shouldn't Splunk hire an historian?

[DUThibault]

Wading through Splunk documents concerning things which have deprecated over time is a pain, as no timeline can be found that explains things clearly. Case in point: Hunk.

Hunk used to be a Splunk product. Legacy documentation exists. But a history of Hunk? Tough luck. Here's what I've pieced together so far:

In 2013 (June), Splunk introduced its virtual index technology that enabled the seamless use of the entire Splunk technology stack—including the Splunk Search Processing Language (SPL)—for interactive exploration, analysis, and visualization of data stored anywhere, as if it were stored in a normal Splunk index. Hunk was the first product to exploit this innovation, delivering Splunk’s interactive data exploration, analysis, and visualizations for Hadoop. Splunk quickly opened this API to NoSQL and other data stores (reference required). In 2014, MongoDB partnered with Splunk to offer a MongoDB results provider for Hunk. By late 2016, Hunk’s functionality was completely incorporated into the Splunk Analytics for Hadoop Add-On (Splunkbase 3311) and Splunk Enterprise itself (versions 6.5+).

The question then is what is the status of the Hunk App for MongoDB (Splunkbase 1810), one of only three MongoDB-related entries in Splunkbase? Shouldn't this app be retired? And what of the eternal question of hooking MongoDB databases up as data sources for Splunk? Shouldn't that be handled by a simple add-on or app? The latest (June 2019) post on that question points to a Unity JDBC driver for MongoDB from a vaguely suspicious URL.

[jkat54]

The old hunk app clearly states it's compatible with Splunk 6.1. I'd call that "vaguely retired" you as the user have to put two and two together there. Are you running 6.1? Even if you are, this app might not work. Maybe that's your point there.

As for the app to connect to mongodb, it's there in your link... dbconnect + mongodb jdbc drivers from unity.

http://www.unityjdbc.com/mongojdbc/mongo_jdbc.php

[DUThibault]

No, that's not my point. My point is that my experience of wading through Splunk's documentation has repeatedly been extremely frustrating because of the abundance of blind alleys. Deprecated stuff is not always clearly marked as such. The occasional disconnect between an older piece of documentation and changed features is understandable, and usually gets corrected pretty fast once it's been pointed out on the offending page.

Getting back to Splunkbase 1810, having the compatibility discreetly marked as "Splunk Versions: 6.1" does not qualify as "clearly". A warning, ideally boxed and highlighted, should appear in the Overview or Details stating that this app is pointless with later versions of Splunk.

And MongoDB? Why is there nothing about JDBC/ODBC databases in the doc? Searching docs.splunk.com for ODBC returns precisely one (!) Documentation hit, and it doesn't mention JDBC at all besides being only concerned with connecting Splunk with Microsoft Excel, MicroStrategy, and Tableau.

Don't get me wrong, the overall Splunk documentation quality is top-notch, but that makes the missteps only stand out more.

[ChrisG]

That's a fair point. We are working on a project to improve the way we document deprecated features, especially for Splunk Enterprise. Some improvements should be rolling out with future releases.