All Apps and Add-ons

Not able to build HDFS schedule report using Splunk Hadoop Connect.

shayan_singla
New Member

I am trying to write data in a csv file using Schedule HDFS Report.
The file is generated but with the Fields name provided only, not the search/fields data.
Please suggest the possible way out.

0 Karma

barakreeves
Splunk Employee
Splunk Employee

Seems the problem is with your search query:
Instead of "index=index_name | fields f1,f2", try this:
index=index_name | search * | fields field1, field2, field3

Make sure you are getting results back before creating a Export job to see if the query is working.

0 Karma

shayan_singla
New Member

the query i wrote was getting the results back.
Tried this query also. But not working.
Still getting the same result, f1,f2 in the file but not data under them.

0 Karma

shayan_singla
New Member

i am just writing:
index=index_name | fields f1,f2
Above is my search query.
And in HDFS Schedule Report, under Fields text field i give f1,f2.
But in the file generated, the data come as "f1,f2" itself. But i want data under fields.

0 Karma

barakreeves
Splunk Employee
Splunk Employee

I do have experience with Hadoop Connect. How many fields are in your search and how many results are you returning from your search? Can you provide your query?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...