We use the Splunk Hadoop Data Roll to move our frozen data over to our Hadoop cluster.  The writing of the data to HDFS seems to work pretty well, but the searching of it through Splunk doesn't work well at all.  We get lots of different errors from the query not parsing correctly (some problem with how splunk translates the parenthesis) or some mysterious error happens in the MR job on Hadoop. We use Cloudera, and would like to be able to query the data there through Hue/Hive as an alternative to our terrible experience trying to query the hadoop data through Splunk.   Can anyone offer guidance on how to query the 'rolled' data on a Cloudera Hadoop cluster without going through Splunk search?   ... View more

How to set the the HEC token value in the flume http sink configuration? flume http sink has the following header props, but neither look like the right thing: acceptHeader contentTypeHeader Anyone had successful experience sinking data from flume into Splunk in some other way? ... View more

We're writing an app that allows users to input some asset lookup data into a KV Store. Occasionally these KV Store records need to be modified or deleted. We're thinking of adding a status field (Active, Inactive, Deleted) and always creating a new KV Store record when these things occur. Any examples around of doing something like this with a KV Store? Is there a way to allow users to modify a custom status field but not modify any other part of the record and not delete a record? Know of a better way to do this? ... View more

I have several fields like this: types.events.1 types.events.2 types.events.3 etc I can use eval to sum them like this eval totalDomainEvents = 'types.events.1' + 'types.events.2' + 'types.events.3' + etc But I have a lot of these fields. Is there a way to do something like this? eval totalDomainEvents = sum('types.events.*') That doesn't work, but hopefully conveys the idea. I'd like to avoid including every field I want included in the eval if possible by just using some kind of wildcard matching to indicate the fields to include in the eval. ... View more

Our Splunk forwarder is sending events that looks something like this: {"consumerTstamp":1488853092650,"metric":"EvTot.byDomain","types":{"events":{}}} {"consumerTstamp":1488853093650,"metric":"EvTot.byDomain","types":{"events":{}}} {"consumerTstamp":1488853094650,"metric":"EvTot.byDomain","types":{"events":{}}} This is obviously 3 events, but Splunk sees it as one. I've been looking at how to get Splunk to separate on newline in a search, but have only found things about setting some property in the configuration. How would I do this in a search? ... View more