Thomas, a) you don't need to run Splunk as a Hadoop super user (hdfs or mapred) in order to access HDFS and/or submit MapReduce jobs. So, as long as the Splunk user has : read permission to the data files write permission to the vix.splunk.home.hdfs (HDFS path) allowed to submit MapReduce jobs you'll be fine b) vix.splunk.home.datanode - is a path in the TaskTracker/DataNode local fs, this path does not need to exist in HDFS. The local fs path needs to be writable to the mapred local user. We default this path to /tmp/splunk/$SPLUNK_SERVER_NAME/ because generally /tmp/ is writable by everyone. btw feel free to reach out to me directly over email so we can resolve your issues faster ledion at splunk dot com ... View more