Does the Splunk .gz sequential indexation constraint (a file at a time) apply while having Hadoop as an External Result Provider?
Having HDFS as the "indexer" makes this somewhat of a gray area to me.
There's no index step for Hunk. You can just place your files in HDFS and search them right away!
View solution in original post
I know in Hunk all extractions and properties are applied at search time but wanted to make sure how this usual Splunk safeguard is handled using Hadoop/HDFS (which I'm still learning the ropes)
Always better to confirm.