Splunk Search

How is Splunk utilizing Map Reduce?

ashishebansal
New Member

How is Splunk utilizing Map Reduce and also, does it use the same tech for SPL and data compression?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think perhaps you're putting too much into the "Map Reduce" term. It probably doesn't mean the same thing as other places where it you've seen it used. In the Splunk world, it means search queries are sent to all indexers for processing. The indexers send their results back to the originating search head which combines the results and finishes processing the query.

---
If this reply helps you, Karma would be appreciated.

dkeck
Influencer
0 Karma

ddrillic
Ultra Champion

Very interesting @dkeck. The document shows the usage of the MapReduce concept, such as the following at the buckets level -

alt text

0 Karma

ashishebansal
New Member

I already tried going through that and the other whitepaper "Technical Paper: Large-Scale, Unstructured Data Retrieval and Analysis Using Splunk".

However, I am still confused on the overall utilization of Map Reduce in Splunk.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...