Hunk User Manual

Search a virtual index

Once you properly install and configure your virtual indexes, you can create reports and visualize data as you would against data in a traditional Splunk index. If you are using Hunk on top of Splunk, you can also choose to gather data from the virtual index alone; or you can query both local and virtual indexes for a single report.

For the most part, you can create reports for virtual indexes much as you would for local indexes. For more information about creating reports, see the Splunk Enterprise Search Manual.

Due to the size and the nature of Hadoop datastores, there are certain Splunk Enterprise index behaviors that cannot be duplicated:

  • Hunk currently doesn't support real-time searching of Hadoop data, although preview functionality is available.
  • Data is not always returned as quickly as data is returned for a local index.
  • Data model acceleration is not available in Hunk.

Since events are not sorted, any search command which depends on implicit time order will not work exactly the way you'd expect. (For example: head, delta, or transaction.) This means that a few search commands operate differently when used on virtual indexes, mostly because of the way Hadoop reports timestamps.

You can still use these commands, and may particularly want to when creating a single report for local and virtual indexes, but you should be aware of how they operate and return data differently.

How Hunk reporting uses search language

For the most part, you can use Splunk Enterprise search language to create your reports. However, because Hunk does not support strict requirements on the order of events, there are a few differences.

The following commands are not supported when the search includes a virtual indexes:

  • transactions
  • localize

The following commands work on virtual indexes, but their results may differ from Splunk. This is because in Hunk, descending time order of events is not guaranteed:

  • streamstats
  • head
  • delta
  • tail
  • reverse
  • eventstats
  • dedup (Since the command cannot distinguish order within an HDFS directory to pick the item to remove, Hunk will choose the item to remove based on modified time, or file order.)
Last modified on 08 December, 2015
Header extractions that do not work in Hunk   Accelerate reports

This documentation applies to the following versions of Hunk®(Legacy): 6.0, 6.0.1, 6.0.2, 6.0.3, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.2, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11

Was this topic useful?

You must be logged into in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters