Can Hunk nodes be part of a multisite search head cluster with search affinity?

[responsys_cm]

My environment has multiple "Big Data" clusters spread all over the world. Can Hunk nodes be part of a multisite search head cluster and can search affinity be used to ensure only a select group of local search heads can run searches against the HDFS/ELK/MongoDB cluster?

Thx.

C

[rdagan_splunk]

Hunk is identical software to Splunk. We only separate the two using a license file.
If you ask Hunk to search your Splunk Indexers (aka search peers), it will be identical behavior as a normal Splunk Search Head.
If you want only specific group of Search Heads to access HDFS, you can create a license group, you can enable Access Control, or you could put Hunk Search Heads on separate IP ..

Just be aware that Hadoop over a WAN is a bad idea. So if your Hunk Search Head will try to access a Remote Hadoop, that will impact your performance.

[rdagan_splunk]

To make sure Hunk access the Local Hadoop, In the Provider you will need to add the local Name Node location and local Yarn Resource Manager location. So just make sure your Hunk instance (Search Head) is pointing to the local HDFS instance. Hunk can have unlimited number of Providers (Hadoop instances) per Hunk node.

Therefore, in the below configurations just make sure your NameNode is set to the local IP, and the same for the Yare Resource Manager.
http://docs.splunk.com/Documentation/Hunk/6.4.0/Hunk/AddanHDFSprovider

[responsys_cm]

If I have multiple HDFS clusters separated by a WAN, is it possible to have a Hunk node that is a member of a search head cluster local to each HDFS cluster and use search head affinity to ensure that no other member of the search head cluster runs searches over the WAN?