Hunk User Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Hunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Known and resolved issues

Version 6.2.6

This topic lists known and resolved issues for Hunk functionality.

Version 6.2.6 of Hunk is a maintenance release that incorporates multiple fixes to Splunk functionality. For a full list of fixes, see the changelog for 6.2.6.

Known Issues

  • Show source page shows VIX related errors even when the search is not against a VIX index. The workaround is to set 'distributed' to 'false' for the show_source stanza in limits.conf:
distributed = false


  • Hunk SH unable to use "show_source" on retrieved results error: show source not available for this event. To mitigate this issue, set distributed = false for show_source stanza in limits.conf
distributed = false


  • For splits that were not Accelerated, searches do not return all results when the time it takes to read Report Accelerated splits is longer than the time it takes to complete the last MapReduce job. (ERP-1366)
  • Hunk searches fail on corrupted journal.gz files, although Splunk searches run without error. (ERP-1343). Workaround is to add that journal.gz to the input path's blacklist (vix.input.1.ignore = ....)
  • Searches may not work on virtual indexes that have multiple paths. (ERP-1319)
  • Required field optimization causes problems with time extraction. With structured data sets (such as csv, avro, parquet etc) Hunk tries to honor the list of required fields as passed down by the search. This may causes issues with _time.

To work around this issue, we recommend that you always use "index-time" _time extraction or add a config option at the virtual-index level to force Hunk to always output a set of fields. (ERP-1201)

  • Report acceleration summary gets deleted when two Hunk instances point to the same Splunk working directory. To mitigate this issue, make sure that vix.splunk.home.hdfs (or Working directory in the UI) is unique on both search heads that are not in a pool. To keep keep your instances in the same working directory, you configure to be unique on both search heads. (ERP-1164)
  • Data Explorer preview does not honor existing sourcetypes for big5/sjis files. (ERP-1216)

Resolved Issues

  • Search hangs if Hadoop client runs out of memory. (ERP-1630)
Last modified on 14 January, 2016
Manage report acceleration
Troubleshoot Hunk

This documentation applies to the following versions of Hunk®(Legacy): 6.2.6

Was this documentation topic helpful?

You must be logged into in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters