Getting Data In

Can I use the same index name in Hunk and Splunk



We are trying out Hunk. The goal is to keep shorter-term data in Splunk and longer-term data in Hunk. Is there any reason that I can't use the same index name for Hunk and Splunk data? If I do this, the searches don't change, and people don't need to know when their data has migrated off Splunk to Hunk.

Tags (2)


also you can correlate data from hunk and splunk with different indexes

0 Karma

Splunk Employee
Splunk Employee

Currently naming the Hunk VIX with the same name as Splunk Index is not allowed.
There are few options that will allow you to combine these two data sets. For example you can create a Search that looks like index=splunk_xyz OR index=hunk_xyz. Another option is to create a single dashboard that includes some panels from Splunk and some from Hunk.

Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...