Splunk Search

How to search files compressed using Snappy from virtual indexes?

chaychoong
New Member

Hi all,

I have a few files (containing syslog events) in my Hadoop HDFS compressed using Snappy, and I configured Splunk to read that data using the virtual indexes.

Without compression, the events appear fine, but with compression, the encoding is all over the place. I was wondering if virtual indexes can be configured to decompress and read snappy files properly.

I'm not an experienced Splunk user, and I apologize if I used some terminologies erroneously.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Yes, Splunk Analytics for Hadoop fully support Snappy files.
What is the error you are seeing? Here is a discussion on the topic: https://answers.splunk.com/answers/154777/does-hunk-take-snappy-files-from-hadoop-as-an-input.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...