All Apps and Add-ons

How to configure Hunk to read Sequence files?

driekhof
Path Finder

Our Hadoop data is in sequence file format (Lz4 compression).

I've configured Hunk on a Cloudera Quickstart VM, and pointed a virtual index to an HDFS parent directory of our data. The data is in sequence file format.

It looks like it it's trying to parse out events, it just does it incorrectly. The events come back as HEX gibberish mostly, with a few readable words.

How do I configure Hunk so it knows these are sequence files??

Tags (2)
0 Karma
1 Solution

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

View solution in original post

0 Karma

driekhof
Path Finder

I found the problem -- in the virtual index provider tab, there is a setting for a regex to match sequence files:

vix.splunk.search.recordreader.sequence.regex

Our files didn't match the default setting ".seq$". I changed it to match our files, and now it works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...