All Apps and Add-ons

How to configure Hunk to read Sequence files?

driekhof
Path Finder

Our Hadoop data is in sequence file format (Lz4 compression).

I've configured Hunk on a Cloudera Quickstart VM, and pointed a virtual index to an HDFS parent directory of our data. The data is in sequence file format.

It looks like it it's trying to parse out events, it just does it incorrectly. The events come back as HEX gibberish mostly, with a few readable words.

How do I configure Hunk so it knows these are sequence files??

Tags (2)
0 Karma
1 Solution

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

View solution in original post

0 Karma

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!