Splunk Search

How to search files compressed using Snappy from virtual indexes?

chaychoong
New Member

Hi all,

I have a few files (containing syslog events) in my Hadoop HDFS compressed using Snappy, and I configured Splunk to read that data using the virtual indexes.

Without compression, the events appear fine, but with compression, the encoding is all over the place. I was wondering if virtual indexes can be configured to decompress and read snappy files properly.

I'm not an experienced Splunk user, and I apologize if I used some terminologies erroneously.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Yes, Splunk Analytics for Hadoop fully support Snappy files.
What is the error you are seeing? Here is a discussion on the topic: https://answers.splunk.com/answers/154777/does-hunk-take-snappy-files-from-hadoop-as-an-input.html

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...