Does anyone have experience indexing an Avro file?
I have Avro data stored in HDFS, but have been unable to find a good way to have Splunk read the binary Avro format without using custom code or other transforms.
Before I go down the custom code path figured I'd ask for other's experiences.
I have tried:
* HadoopConnector - Underlying hadoop fs commands (at least on my CDH4 system) return binary data.
* Flume - Doesn't seem to be able to read in an Avro file source.
* Hue + Splunk w/ http GET - this gets ugly quickly and is super inefficient.
Thanks
... View more