Use Hunk and Splunk Enterprise together

To search local indexes (data sent from forwarders to Splunk indexers) and Hadoop directories at the same time, you can install licenses for both Hunk and Splunk.

For information about licensing, see "Download and Install Hunk."

When you set up Splunk with the specific purpose of configuring Hunk (whether you also plan to use Splunk Enterprise functionality as well), you configure your MapReduce user as the user who runs Splunk during the initial configuration.

However, if you install a Hunk license on an existing configured Splunk installation, you will likely need to reconfigure the original Splunk user to have proper permissions against Hadoop.

For example, if you installed Splunk as root (which is not recommended) and then you install Hunk, MapReduce jobs are spawned as the root user, which is likely not allowed by your Hadoop administrator. Resolve this by giving your MapReduce user permissions to Splunk and then reassigning your MapReduce user as the Splunk/Hunk user. See "Configure user impersonation" to configure your MapReduce user.