Anil, it depends on what you mean by real-time. Hunk, with the hadoop provider or with the mongodb provider does not provide a real-time capability like Splunk Enterprise does. To be clear - you can run a Splunk Enterprise search in true "real time" and as soon as the incoming data hits a Splunk indexer, it is available for display on a dashboard or a tablet or whatever. With Hunk, we're executing map-reduce jobs in a hybrid model (against HDFS or nosql stores).
As I see it you have the following options.
- Use Hunk against MongoDB and simply run very frequent searches. We have seen customers run MongoDB searches once a minute like this, and the dashboard would update every minute. Perhaps that is close enough to real time for you.
- Use DB Connect, by installing a JDBC driver as shown here: http://www.unityjdbc.com/mongojdbc/setup/mongodb_jdbc_splunk.pdf. You can then use the dbquery command or you can index your MongoDB data in Splunk using a dbmon-tail and then truly use Splunk Enterprise's real-time capability.
If you truly have logs on a Windows server, there's no need to involve MongoDB at all here, by the way. You can simply use a Universal Forwarder to stream these logs in real-time to Splunk Enterprise, and get real-time visualization that way. You can even use the Splunk Mobile Access Server to serve up content to iPads.
