Splunk Search

Does Hunk support SPL?

mohitab
Path Finder

This could be a premature question and a bit hypothetical too.

I have a visual analytics based webapp based on Splunk Enterprise 6 which hosts small csv data of a few MB. The visualizations are produced by querying and processing data which is a bit complex. The use case my project has no real intention of using data records as events. My queries are not designed to run on 'recent' data. All data is used.

I was wondering if I could port my data to Hunk and use the same queries. Does Hunk support SPL completely? Does all SPL commands gets spawned into map/reduce tasks?

Tags (2)
0 Karma
1 Solution

Petter_Eriksson
Splunk Employee
Splunk Employee

From: http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunk/Searchavirtualindex

Since events are not sorted, any search command which depends on implicit time order will not work exactly the way you'd expect. (For example: head, delta, or transaction.) This means that a few search commands operate differently when used on virtual indexes, mostly because of the way Hadoop reports timestamps. You can still use these commands, and may particularly want to when creating a single report for local and virtual indexes, but you should be aware of how they operate and return data differently.

So the answer is, kind of. All your searches may not work as you'd expect, but most of them work just as you'd expect by spawning efficient map/reduce jobs.

View solution in original post

Petter_Eriksson
Splunk Employee
Splunk Employee

From: http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunk/Searchavirtualindex

Since events are not sorted, any search command which depends on implicit time order will not work exactly the way you'd expect. (For example: head, delta, or transaction.) This means that a few search commands operate differently when used on virtual indexes, mostly because of the way Hadoop reports timestamps. You can still use these commands, and may particularly want to when creating a single report for local and virtual indexes, but you should be aware of how they operate and return data differently.

So the answer is, kind of. All your searches may not work as you'd expect, but most of them work just as you'd expect by spawning efficient map/reduce jobs.

piebob
Splunk Employee
Splunk Employee

yes, Hunk supports SPL. there's a lot of good documentation for this here:

http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunk/MeetHunk

i recommend you try out the tutorial:
http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunktutorial/Tutorialoverview

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...