Splunk Search

How do hunk/hadoop searches work?

JohnTelus
New Member

Does, for example, hunk retrieve all the data from the hadoop path, move it to a temporary location, apply the search criteria, and then return the results to the user?

Tags (3)
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

rdagan_splunk
Splunk Employee
Splunk Employee

Hunk converts the search into Hadoop MR Job. With virtual indexes, Hunk can access subset of the data. Hunk leverages the MapReduce framework to execute report-generating searches and Indexing on Hadoop nodes. Data does not need to be pre-processed before it is accessed because Hunk lets you run analytics searches against the data where it rests in Hadoop. In addition, Data Preview for Exploration is done by allowing Hunk to look at subset of the data after each phase of the MR Job.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...