Getting Data In
Highlighted

Hunk - gz indexation

Builder

Does the Splunk .gz sequential indexation constraint (a file at a time) apply while having Hadoop as an External Result Provider?
Having HDFS as the "indexer" makes this somewhat of a gray area to me.

0 Karma
Highlighted

Re: Hunk - gz indexation

Splunk Employee
Splunk Employee

There's no index step for Hunk. You can just place your files in HDFS and search them right away!

View solution in original post

Highlighted

Re: Hunk - gz indexation

Builder

Cool Petter.
I know in Hunk all extractions and properties are applied at search time but wanted to make sure how this usual Splunk safeguard is handled using Hadoop/HDFS (which I'm still learning the ropes)
Always better to confirm.

Cheers