Hi All, We are in need to export the data from Splunk to Hadoop. I have come across the hadoop connect app and i am in the process of setting it up. Question that i have is around it's reliability, my usecase is to export pretty much all the data that comes to splunk(500+ gb/day). Is this app reliable to handle this volume? If NOT what volume it can handle and any suggestions on the approach to deal with exporting 500+ gb volume. Also are they any performance impact of this app running on SearchHead and exporting this volume of data, anything that we need to be aware off, We plan to schedule the export every 30 mins or so. Any other aspect/scenario/limitation which we need to be aware off. Note: 500 gb/day is currently getting indexed so IT team needs this to be done from splunk and NOT from source, all future data which will be onboarded, will be sent to both splunk and hadoop. Splunk Version : 6.5.2 Cloudera Enterprise 5.10.1 (hadoop-2.6.0) Kerberos Secured Note :Looking for some guidance will award points for the appropriate/working suggestions ... View more

Hi All I am running into some strange behavior(atleast for me) with dashboard submit button Dashboard has time picker 1 textbox input [which takes comma separated order numbers] Submit button My usecase is to allow the Support teams look up customer details using order numbers[they can enter any number of orders 1 or 10 or 100 or 1000 all , seperated], output gives customer name,custmer email,order number. When i choose the time , key in say 2 order numbers and hit submit button ...my panel searches are not triggered as the tokens are not passed on to panels(i am displaying tokens in panel titles), however when i click the cross max on the text box to remove the value and click anywhere on dashboard[i am not clicking submit button] the tokens are being passed and the panels work. In short submit button does not seem to work. Any idea why this behavior is happening and how it can be corrected. Example: Input=ord123,ord234,ord345 search becomes -->index=xyz ord123 OR ord234 OR ord345| table orderid,cust_firstname,cust_lastname,cust_email Label -->Customer Details---ord123 OR ord234 OR ord345 <form> <label> Customer Details using Order Number</label> <fieldset submitButton="true" autoRun="false"> <input type="time" token="time_token" searchWhenChanged="false"> <label>Select Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <input type="text" token="Orderid_token" searchWhenChanged="false"> <label>Enter OrderNumber</label> <change> <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval> </change> </input> </fieldset> <row> <panel> <title>Customer Details---$Orderid_frmt_token$</title> <table> <search> <query>index=xyz $Orderid_frmt_token$| table orderid,cust_firstname,cust_lastname,cust_email </query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more