Using the Hadoop Connect Import function, make sure that the Resource name path is high level enough to deal with the daily changes. So if for example you have hadoop.example.com:8020/year/month/day/hour/ you can change it to hadoop.example.com:8020/year/ https://docs.splunk.com/Documentation/HadoopConnect/latest/DeployHadoopConnect/ImportfromHDFS Also, you may want to look at Splunk Analytics for Hadoop as a way to monitor HDFS files https://www.splunk.com/blog/2013/11/08/hunk-intro-part-3.html https://www.splunk.com/blog/2014/05/14/hunkonhunk.html ... View more

Chimell, i have already gone through this link. i think my question was not clear. When i said the link between this two, i meant splunk-to-Java. i want to invoke execution of java code on splunk server which should be done by clicking on a button. 1. i have html and js form, which is client side. 2. on click of a button need to send some parameters to server side.(by hitting some another page) 3. this parameter should be handled and processed by JAVA. in order to do that a execution must enter into java code. ... View more

reading the docs on limits.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf it looks like there is no limit by default: maxvalues = <integer> * Maximum number of values for any field to keep track of. * When set to “0”: Specifies an unlimited number of values. * Default: 0 ... View more

Thanks for your reply Martin. I have gone through all solution suggested by you. First:- In this case we have different indexers not source types and the use-case is too complex to handle with stats command. Second:- All this data is coming from Oracle database base and its a transactional data which keeps on changing so using a lookup is also bit difficult here. Although I am currently using lookup to store the output of first query and latter using it in second query to perform join. Please let me know if you meant something else by using lookup. Third:- even I was thinking of this option but am not sure how to implement this. As per the requirement I need to pull in last 7 days data and if I schedule a query to run every day and send data to SPLUNK, in that case there will be duplicate records of last 6 days. probs: 1. how to remove duplicates or stop them getting indexed. 2. is there any possibility that performing join at database side can create any issue? 3. will it impact database performance? Could you please be more specific on how to perform join at database side and get the final result into SPLUNK. please let me know if any additional information is needed. thanks in advance. ... View more

did you get solution for this ?? am getting the same error. please share if you already solved it. thanks ... View more