There is a setup video on this page to setup Hunk with HDP 1.1.3 (all the way at the bottom): http://hortonworks.com/hadoop-tutorial/configure-hortonworks-sandbox-version-2-0-with-hunk-splunk-analytics-for-hadoop/ The configurations to setup Hunk with HDP 2.1 is slightly different (due to Yarn). Here is my configurations based on HDP 2.1 Sandbox: [provider:hunk62hdprovider] vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-s6.0-hy2.0.jar vix.description = Hunk 62 Hortonworks 2.1 Provider vix.env.HADOOP_HOME = /usr vix.env.JAVA_HOME = /usr vix.family = hadoop vix.fs.default.name = hdfs://sandbox:8020 vix.mapreduce.framework.name = yarn vix.splunk.home.hdfs = /user/root/hunk62mr vix.yarn.resourcemanager.address = sandbox:8050 vix.yarn.resourcemanager.scheduler.address = sandbox:8030 ... View more

you can use pipe character to separate it regex url="(:1000/[a-zA-Z0-9]{10,20}?[a-zA-Z0-9]{30} OR //[0-9a-zA-Z.]{50,80}/[0-9a-zA-Z.]{32}/)|(:1000/[a-zA-Z0-9]{10,20}?[a-zA-Z0-9]{30} | //[0-9a-zA-Z.]{50,80}/[0-9a-zA-Z.]{32}/)" ... View more