Splunk Search
Highlighted

How to search files compressed using Snappy from virtual indexes?

New Member

Hi all,

I have a few files (containing syslog events) in my Hadoop HDFS compressed using Snappy, and I configured Splunk to read that data using the virtual indexes.

Without compression, the events appear fine, but with compression, the encoding is all over the place. I was wondering if virtual indexes can be configured to decompress and read snappy files properly.

I'm not an experienced Splunk user, and I apologize if I used some terminologies erroneously.

0 Karma
Highlighted

Re: How to search files compressed using Snappy from virtual indexes?

Splunk Employee
Splunk Employee

Yes, Splunk Analytics for Hadoop fully support Snappy files.
What is the error you are seeing? Here is a discussion on the topic: https://answers.splunk.com/answers/154777/does-hunk-take-snappy-files-from-hadoop-as-an-input.html

0 Karma