What exactly do you mean by a provider in hunk?

[sarnagar]

Hi ALL,

I was reading about HUNK on splunk.doc. They mention something about provider , ERP and configuration of this provider in indexes.conf....
Can someone please explain me what exactly is this provider??
Also How HUNK works using ERP??
Appreciate your help on this. Thankyou.

[jworthington_sp · Accepted solution]

Yep, the provider is simply whoever is hosting your data. It could be Hadoop, or it could be something like s3 or NoSQL.

An ERP - External Results Provider - is a process. It's provided by Splunk (unless you write your own), It uses info you configure about the provider to communicate with and gather the result from the Provider (i.e., Hadoop). When you configure a Provider, you are technically configuring an ERP as well, because that's the info the ERP uses.

I think this naming convention is a little confusing, I'll see if I can make the docs a little more clear.

[muebel]

Hi sarnagar, The provider concept seems to indicate an "external resource provider" for the virtual indexes. I.E. hadoop, but they've kept this open ended enough to imply that other providers are possible.

Please let me know if this helps!

[Ledion_Bitincka]

Quick clarification ERP stands for "external results provider" - in Splunk the provider of results/events are the native indexes, in Hunk the results/events are provided by an external source, Hadoop, MongoDb, etc