@ziegfried - If I push a file to splunk once a day with the above configuration with _time events up to 60 days old, when will they be removed? How do these events get organized by bucket? example: test_index_10_27_2015.csv (events over the past 60 days) test_index_10_26_2015.csv (events over the past 60 days) test_index_10_25_2015.csv (events over the past 60 days) test_index_10_24_2015.csv (events over the past 60 days) ... View more

@pinVie - IMHO, I think you're asking the right question. Here is my take on the pros/cons: Hunk Pros: 1. Easy to use with pre-existing Hadoop clusters 2. No forwarder or indexer setup required Cons: 3. Has inherent delay in search results that comes with traditional map reduce jobs 4. You have to manage a Hadoop cluster unless you use something like Amazon (Even there you'll have to manage it) Splunk Pros: 1. Speed (We did testing of the same scenario. In our scenario, with the same computer power, Splunk won) 2. Splunk Manages many of the details for you 3. Only need to manage one stack and not an outside cloud stack 4. Heard that Splunk is map/reduce written in c++ with python front end and it will be hard to beat the implementation 5. More mature product even though the Hunk team is very responsive Cons: 1. Configuration will be more complex on the Splunk side. You will probably need an indexer cluster and forwarders to get your data into splunk. 2. Vendor Lock in. I've had customers say that if they want to do other things with the data they cannot manipulate the data once it is in Splunk and they were worried about their vendor lock in ... View more

Is the error referring to this? "Access-Control-Allow-Headers": "Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With" where you're using Access-Control-Allow-Headers in the variable Access-Control-Allow-Headers? ... View more

Is this still the case with the username? Why is the username so tightly coupled to the account? Couldn't a surrogate key be used instead of the username? ... View more

Sitting at .conf2015. Just heard about the new Distributed Management... Looks like we could have an answer. ... View more

We have enterprise Splunk coupled with Hunk. I'm guessing these two limits are tied together and there is no possibility of separating them? ... View more

So basically we're stuck with bash or a scripting language? No administrative UI to do this, correct? ... View more

lol. Is that better? ... View more

Sounds like it might be configurable? ... View more

@kschon - Thanks for the explanation. I was just trying to figure out where the compute happened and to understand the limitations, etc. If I have Billions of records and I run in verbose mode, I'm guessing the performance would be much worse than the MR job with fast mode. (search head processing vs. hadoop cluster) ... View more

We have static log files that get created once a day and we're looking for a way to verify that the data made it to Splunk. We're thinking that we'd have to query Splunk through the Rest interface to verify that the data made it. ... View more

Our files are static and we don't do Windows but definitely true. ... View more

Thanks for the ammunition. They relented... 🙂 ... View more

What else does it provide besides buffering, failover, and a round robin load balance (not a true load balance)? That is what I'm trying to explain to them. ... View more

I'm not but I need reasons to convince my team otherwise. ... View more

i.e. - Is the summary index stored in hdfs or Splunk? Is it just a scheduled mapreduce job? ... View more

Maybe someone could comment on the implementation? ... View more

Sorry, just saw this post. http://answers.splunk.com/answers/112367/can-i-use-summary-index-in-hunk-environment-for-report-performance-improvement.html ... View more