Splunk Hadoop Connect: How to run a query directly on Hadoop data without indexing? Is there a performance impact?

[chanduira]

Dear Experts,

Just to know, using Hadoop Connect App, is it possible to run query directly on Hadoop data without indexing (in Splunk indexer).

If yes, is there any performance impact?

[sdaniels]

The Hadoop Connect App does not allow you to perform queries directly on Hadoop without indexing the data. Hadoop Connect provide you three options: Export data to Hadoop, Explore, Hadoop directories and files and finally Import and Index Hadoop data.

What i believe you are looking for is our Hunk product. http://www.splunk.com/en_us/products/hunk.html It will allow you to search all of your Hadoop data and the impact to your Hadoop environment is just like any other jobs you perform in Hadoop. You can try it here for free for 60 days. http://www.splunk.com/en_us/download/hunk.html