Getting Data In

Can I use the same index name in Hunk and Splunk

a212830
Champion

Hi,

We are trying out Hunk. The goal is to keep shorter-term data in Splunk and longer-term data in Hunk. Is there any reason that I can't use the same index name for Hunk and Splunk data? If I do this, the searches don't change, and people don't need to know when their data has migrated off Splunk to Hunk.

Tags (2)

kml_uvce
Builder

also you can correlate data from hunk and splunk with different indexes

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Currently naming the Hunk VIX with the same name as Splunk Index is not allowed.
There are few options that will allow you to combine these two data sets. For example you can create a Search that looks like index=splunk_xyz OR index=hunk_xyz. Another option is to create a single dashboard that includes some panels from Splunk and some from Hunk.

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...