Getting Data In

settings to configure hunk for Hive ORC table

pawantiwari3987
Explorer

Hi Team,
Please help us in configuring hadoop provider/virtual index so that we can map it on hive orc table. we are able to search on simple/text table however when we give path of orc table it show output in some unreadable format.

Regards
Pawan Tiwari

Tags (1)
0 Karma

hyan_splunk
Splunk Employee
Splunk Employee

For any hive formats other than text, you need to specify fileformat property. So in your case:

vix.input.1.splitter.hive.fileformat = orc

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

If you have access to the Metastore URI, it should look similar to this example

In the Provider add these two flags:
vix.splunk.search.splitter = HiveSplitGenerator
vix.hive.metastore.uris = thrift://sandbox:9083 (you can find the value in hive-site.xml)

In the Virtual Index you will need to point to the actual ORC file, DB Name, Table Name:
[employee_orc]
vix.input.1.path = /apps/hive/warehouse/employees_orc
vix.provider = HiveHDPProvider
vix.input.1.splitter.hive.dbname = default
vix.input.1.splitter.hive.tablename = employees_rc

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...