All Apps and Add-ons

How to configure Hunk to read Sequence files?

driekhof
Path Finder

Our Hadoop data is in sequence file format (Lz4 compression).

I've configured Hunk on a Cloudera Quickstart VM, and pointed a virtual index to an HDFS parent directory of our data. The data is in sequence file format.

It looks like it it's trying to parse out events, it just does it incorrectly. The events come back as HEX gibberish mostly, with a few readable words.

How do I configure Hunk so it knows these are sequence files??

Tags (2)
0 Karma
1 Solution

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

View solution in original post

0 Karma

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!