Known and resolved issues

Version 6.2.6

This topic lists known and resolved issues for Hunk functionality.

Version 6.2.6 of Hunk is a maintenance release that incorporates multiple fixes to Splunk functionality. For a full list of fixes, see the changelog for 6.2.6.

Known Issues

• Show source page shows VIX related errors even when the search is not against a VIX index. The workaround is to set 'distributed' to 'false' for the show_source stanza in limits.conf:

limits.conf
[show_source]
distributed = false

(ERP-1594)

• Hunk SH unable to use "show_source" on retrieved results error: show source not available for this event. To mitigate this issue, set distributed = false for show_source stanza in limits.conf

limits.conf
[show_source]
distributed = false

(ERP-1431)

• For splits that were not Accelerated, searches do not return all results when the time it takes to read Report Accelerated splits is longer than the time it takes to complete the last MapReduce job. (ERP-1366)

• Hunk searches fail on corrupted journal.gz files, although Splunk searches run without error. (ERP-1343). Workaround is to add that journal.gz to the input path's blacklist (vix.input.1.ignore = ....)

• Searches may not work on virtual indexes that have multiple paths. (ERP-1319)

• Required field optimization causes problems with time extraction. With structured data sets (such as csv, avro, parquet etc) Hunk tries to honor the list of required fields as passed down by the search. This may causes issues with _time.

To work around this issue, we recommend that you always use "index-time" _time extraction or add a config option at the virtual-index level to force Hunk to always output a set of fields. (ERP-1201)

• Report acceleration summary gets deleted when two Hunk instances point to the same Splunk working directory. To mitigate this issue, make sure that vix.splunk.home.hdfs (or Working directory in the UI) is unique on both search heads that are not in a pool. To keep keep your instances in the same working directory, you configure vix.splunk.search.cache.path to be unique on both search heads. (ERP-1164)

• Data Explorer preview does not honor existing sourcetypes for big5/sjis files. (ERP-1216)

Resolved Issues

• Search hangs if Hadoop client runs out of memory. (ERP-1630)