Splunk Hadoop Connector

1. Easily and reliably move data between Splunk Enterprise™ and Hadoop
Splunk® Hadoop® Connect
F a c t S h e e t
Enter Splunk
Splunk Hadoop Connect enables you to benefit from the best
of both worlds. Quickly deploy Splunk Enterprise for real-time
collection, indexing, analysis and visualizations and then reliably
forward events to Hadoop for long-term archiving and additional
batch analytics. Further leverage Splunk software by importing
and indexing data already stored in Hadoop. With Splunk Hadoop
Connect, you can stand up reliable, secure, enterprise-grade big
data projects in days instead of months.
Key Features and Benefits
Splunk Hadoop Connect provides the following core features:
Export events to Hadoop – Collect and index massive streams
of machine data in real time using Splunk software. Search,
analyze and visualize your data and provide secure dashboards
to multiple users across your organization. You can send events
in a reliable, predictable way to HDFS for archiving, further
processing or additional batch analytics. Users have several
options when exporting events. They can pre-process data in
Splunk Enterprise before exporting the results into Hadoop, or
they can simply export raw events. For example, when processing
Apache web logs, users can limit the data export to just the
client IP, session ID and the URL fields.
Explore Hadoop directories and files – Browse and navigate
HDFS directories and files from the Splunk Hadoop Connect
user interface, before deciding to import data into Splunk. View
directories, files names, permissions, sizes and dates of the last
modification, all without having to open the actual files. Drill
down into a set of directories, examine files and with a click of a
button import and index data in Splunk.
Challenges Developing Hadoop Applications
Developing Hadoop applications is time consuming. Finding
or training data scientists to get value from your data is also
challenging. As a result, most Hadoop-related projects take a long
time to develop, and once developed, still require specialized
knowledge to adapt to new requirements.
• Export events collected and aggregated in
Splunk Enterprise reliably to HDFS
• Explore and browse HDFS directories and files
• Import and index data from HDFS for secure
searching, reporting, analysis and visualizations
in Splunk
H i g h l i g h t s
Bi-directional integration between Splunk and Hadoop.
Quickly and easily export data to Hadoop.

2. www.splunk.comlisten to your data
250 Brannan St, San Francisco, CA, 94107 info@splunk.com | sales@splunk.com 866-438-7758 | 415-848-8400 www.splunkbase.com
F a c t s h e e t
Copyright © 2013 Splunk Inc. All rights reserved. Splunk Enterprise is protected by U.S. and international copyright and intellectual property laws.
Splunk is a registered trademark or trademark of Splunk Inc. in the United States and/or other jurisdictions. All other marks and names mentioned
herein may be trademarks of their respective companies. Item # FS-splunk-Hadoop-Connect-107
Import and index Hadoop data in Splunk – Address Hadoop
limitations, such as the lack of visualizations, limited support
for user access controls, and the need for data scientists and
specialists to analyze data or to write MapReduce code. Splunk
Hadoop Connect detects any updated or new file in the HDFS
directory (for example as a result of Sqoop, Hbase or Hadoop
commands) and imports the data into Splunk indexers. Once
in Splunk Enterprise, your data is immediately available for
searching, reporting, analysis and visualizations and protected
by role-based access controls.
Product Requirements
Supported Hadoop Versions
Splunk Hadoop Connect is compatible with Apache Hadoop;
it is also tested and certified against Cloudera’s CDH and
Hortonworks’ HDP distribution. Additionally, Splunk Hadoop
Connect supports any locally mounted point, which enables
it to work with MapR or IBM GPFS distributions. Refer to the
product documentation for the latest list of supported Hadoop
distributions.
Splunk Requirements
All instances of Splunk Enterprise in a Splunk Hadoop Connect
deployment require version 4.3.2 or later. The ability to index
Hadoop data requires Splunk Modular Inputs, which is a feature
of Splunk Enterprise 5.0, or later.
F a c t s h e e t
Try Out the App, it’s Free!
Go to http://splunk-base.splunk.com to learn more.
Free Download
Download Splunk You’ll get a Splunk Enterprise license for 60
days and you can index up to 500 megabytes of data per day.
You can convert to a perpetual Free license or purchase an
Enterprise license by contacting sales@splunk.com.