Known and resolved issues

Version 6.2.2

This topic lists known and resolved issues for Hunk functionality.

Version 6.2.2 of Hunk is a maintenance release that incorporates multiple fixes to Splunk functionality. For a full list of fixes, see the changelog for 6.2.2.

Known Issues

• For splits that were not Accelerated, searches do not return all results when the time it takes to read Report Accelerated splits is longer than the time it takes to complete the last MapReduce job. (ERP-1366)

• Data explorer does not work for a provider and virtual index that are set up to run MapReduce as a different user. ERP-1349

• Hunk searches fail on corrupted journal.gz files, although Splunk searches run without error. (ERP-1343). Workaround is to add that journal.gz to the input path's blacklist (vix.input.1.ignore = ....)

• Searches may not work on virtual indexes that have multiple paths. (ERP-1319)

• Required field optimization causes problems with time extraction. With structured data sets (such as csv, avro, parquet etc) Hunk tries to honor the list of required fields as passed down by the search. This may causes issues with _time.

To work around this issue, we recommend that you always use "index-time" _time extraction or add a config option at the virtual-index level to force Hunk to always output a set of fields. (ERP-1201)

• Report acceleration summary gets deleted when two Hunk instances point to the same Splunk working directory. To mitigate this issue, make sure that vix.splunk.home.hdfs (or Working directory in the UI) is unique on both search heads that are not in a pool. To keep keep your instances in the same working directory, you configure vix.splunk.search.cache.path to be unique on both search heads. (ERP-1164)

• Data Explorer preview does not honor existing sourcetypes for big5/sjis files. (ERP-1216)