Can I use the same index name in Hunk and Splunk

[a212830]

Hi,

We are trying out Hunk. The goal is to keep shorter-term data in Splunk and longer-term data in Hunk. Is there any reason that I can't use the same index name for Hunk and Splunk data? If I do this, the searches don't change, and people don't need to know when their data has migrated off Splunk to Hunk.

[kml_uvce]

also you can correlate data from hunk and splunk with different indexes

[rdagan_splunk]

Currently naming the Hunk VIX with the same name as Splunk Index is not allowed.
There are few options that will allow you to combine these two data sets. For example you can create a Search that looks like index=splunk_xyz OR index=hunk_xyz. Another option is to create a single dashboard that includes some panels from Splunk and some from Hunk.