Does Hunk support SPL?

[mohitab]

This could be a premature question and a bit hypothetical too.

I have a visual analytics based webapp based on Splunk Enterprise 6 which hosts small csv data of a few MB. The visualizations are produced by querying and processing data which is a bit complex. The use case my project has no real intention of using data records as events. My queries are not designed to run on 'recent' data. All data is used.

I was wondering if I could port my data to Hunk and use the same queries. Does Hunk support SPL completely? Does all SPL commands gets spawned into map/reduce tasks?

[Petter_Eriksson · Accepted solution]

From: http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunk/Searchavirtualindex

Since events are not sorted, any search command which depends on implicit time order will not work exactly the way you'd expect. (For example: head, delta, or transaction.) This means that a few search commands operate differently when used on virtual indexes, mostly because of the way Hadoop reports timestamps. You can still use these commands, and may particularly want to when creating a single report for local and virtual indexes, but you should be aware of how they operate and return data differently.

So the answer is, kind of. All your searches may not work as you'd expect, but most of them work just as you'd expect by spawning efficient map/reduce jobs.

[piebob]

yes, Hunk supports SPL. there's a lot of good documentation for this here:

http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunk/MeetHunk

i recommend you try out the tutorial:
http://docs.splunk.com/Documentation/Hunk/6.2.2/Hunktutorial/Tutorialoverview