Deployment Architecture

Can Hunk nodes be part of a multisite search head cluster with search affinity?

responsys_cm
Builder

My environment has multiple "Big Data" clusters spread all over the world. Can Hunk nodes be part of a multisite search head cluster and can search affinity be used to ensure only a select group of local search heads can run searches against the HDFS/ELK/MongoDB cluster?

Thx.

C

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Hunk is identical software to Splunk. We only separate the two using a license file.
If you ask Hunk to search your Splunk Indexers (aka search peers), it will be identical behavior as a normal Splunk Search Head.
If you want only specific group of Search Heads to access HDFS, you can create a license group, you can enable Access Control, or you could put Hunk Search Heads on separate IP ..

Just be aware that Hadoop over a WAN is a bad idea. So if your Hunk Search Head will try to access a Remote Hadoop, that will impact your performance.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

To make sure Hunk access the Local Hadoop, In the Provider you will need to add the local Name Node location and local Yarn Resource Manager location. So just make sure your Hunk instance (Search Head) is pointing to the local HDFS instance. Hunk can have unlimited number of Providers (Hadoop instances) per Hunk node.

Therefore, in the below configurations just make sure your NameNode is set to the local IP, and the same for the Yare Resource Manager.
http://docs.splunk.com/Documentation/Hunk/6.4.0/Hunk/AddanHDFSprovider

0 Karma

responsys_cm
Builder

If I have multiple HDFS clusters separated by a WAN, is it possible to have a Hunk node that is a member of a search head cluster local to each HDFS cluster and use search head affinity to ensure that no other member of the search head cluster runs searches over the WAN?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...