Does the Splunk .gz sequential indexation constraint (a file at a time) apply while having Hadoop as an External Result Provider?
Having HDFS as the "indexer" makes this somewhat of a gray area to me.
There's no index step for Hunk. You can just place your files in HDFS and search them right away!
There's no index step for Hunk. You can just place your files in HDFS and search them right away!
Cool Petter.
I know in Hunk all extractions and properties are applied at search time but wanted to make sure how this usual Splunk safeguard is handled using Hadoop/HDFS (which I'm still learning the ropes)
Always better to confirm.
Cheers