How to search files compressed using Snappy from virtual indexes?

[chaychoong]

Hi all,

I have a few files (containing syslog events) in my Hadoop HDFS compressed using Snappy, and I configured Splunk to read that data using the virtual indexes.

Without compression, the events appear fine, but with compression, the encoding is all over the place. I was wondering if virtual indexes can be configured to decompress and read snappy files properly.

I'm not an experienced Splunk user, and I apologize if I used some terminologies erroneously.

[rdagan_splunk]

Yes, Splunk Analytics for Hadoop fully support Snappy files.
What is the error you are seeing? Here is a discussion on the topic: https://answers.splunk.com/answers/154777/does-hunk-take-snappy-files-from-hadoop-as-an-input.html