Deployment Architecture

Can Hunk nodes be part of a multisite search head cluster with search affinity?

responsys_cm
Builder

My environment has multiple "Big Data" clusters spread all over the world. Can Hunk nodes be part of a multisite search head cluster and can search affinity be used to ensure only a select group of local search heads can run searches against the HDFS/ELK/MongoDB cluster?

Thx.

C

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Hunk is identical software to Splunk. We only separate the two using a license file.
If you ask Hunk to search your Splunk Indexers (aka search peers), it will be identical behavior as a normal Splunk Search Head.
If you want only specific group of Search Heads to access HDFS, you can create a license group, you can enable Access Control, or you could put Hunk Search Heads on separate IP ..

Just be aware that Hadoop over a WAN is a bad idea. So if your Hunk Search Head will try to access a Remote Hadoop, that will impact your performance.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

To make sure Hunk access the Local Hadoop, In the Provider you will need to add the local Name Node location and local Yarn Resource Manager location. So just make sure your Hunk instance (Search Head) is pointing to the local HDFS instance. Hunk can have unlimited number of Providers (Hadoop instances) per Hunk node.

Therefore, in the below configurations just make sure your NameNode is set to the local IP, and the same for the Yare Resource Manager.
http://docs.splunk.com/Documentation/Hunk/6.4.0/Hunk/AddanHDFSprovider

0 Karma

responsys_cm
Builder

If I have multiple HDFS clusters separated by a WAN, is it possible to have a Hunk node that is a member of a search head cluster local to each HDFS cluster and use search head affinity to ensure that no other member of the search head cluster runs searches over the WAN?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...