splunk
Bucket Reader
Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
This app allows you to read data in Splunk buckets using 3rd-party Hadoop-based applications. When you use the Hunk archiving functionality to export your raw-data journal files to HDFS, you can immediately query and analyze that data via Hunk.
But what if you want to also view that data via applications like Hive or Pig? This app provides Hadoop tool classes that allow you to do just that:
* Provides classes that implement both the “old-style” and new “new-style” Hadoop interfaces, based on the org.apache.hadoop.mapred and org.apache.hadoop.mapreduce packages.
* Provides access to index-time fields only — search-time fields are not available.
* Lets you configure which fields are retrieved as keys and as values.
* Formats returned data as TSV.
After installing this app, open it in Hunk. The documentation tab will provide complete usage instructions, including examples.
But what if you want to also view that data via applications like Hive or Pig? This app provides Hadoop tool classes that allow you to do just that:
* Provides classes that implement both the “old-style” and new “new-style” Hadoop interfaces, based on the org.apache.hadoop.mapred and org.apache.hadoop.mapreduce packages.
* Provides access to index-time fields only — search-time fields are not available.
* Lets you configure which fields are retrieved as keys and as values.
* Formats returned data as TSV.
After installing this app, open it in Hunk. The documentation tab will provide complete usage instructions, including examples.
Release Notes
Version 1.2.3
Dec. 7, 2016
Version 1.0beta
May 29, 2015