topic Re: Why is the Hunk timestamp column displaying hex character? in Getting Data In

Why is the Hunk timestamp column displaying hex character?

samardutta — Tue, 29 Sep 2020 13:17:20 GMT

Trying to query custom log in s3 in json parquet format through Hunk. But for some reason hunk is not displaying timestamp field "starttime" correctly.

{"ap_mac_address":"FF-FF-FF-FF-FF-FF","base_user_name":"00:25:4B:98:6C:BF","starttime":"��\t��\u0011\u0000\u0000�%\u0000","uniquehash":"6393fb43ffb35fa93b051f0b3ab8b3f4"...}

When I query the same file with other tools like hive/impala it display correct timestamp.

Are there any setting to display the timestamp correctly?

thanks.

Re: Why is the Hunk timestamp column displaying hex character?

kpawar_splunk — Thu, 06 Apr 2017 18:55:42 GMT

What is the type of timestamp field(starttime). Is it int96, int64 or some other type.

Re: Why is the Hunk timestamp column displaying hex character?

samardutta — Thu, 06 Apr 2017 18:57:17 GMT

It is INT96 type

Re: Why is the Hunk timestamp column displaying hex character?

kpawar_splunk — Thu, 06 Apr 2017 19:03:08 GMT

INT96 type is deprecated by parquet.
Official link here : https://issues.apache.org/jira/browse/PARQUET-323
Hunk currently does not support int96 type.
You can follow recommendation in the link (https://issues.apache.org/jira/browse/PARQUET-323) to replace int96 with some other type.