drill-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Takeo Ogawara <ta-ogaw...@kddi-research.jp>
Subject Re: ***UNCHECKED*** Re: Query Error on PCAP over MapR FS
Date Tue, 12 Sep 2017 04:03:46 GMT
Query on directory and wildcard works well!
Thank you so much.

> 2017/09/12 12:13、Ted Dunning <ted.dunning@gmail.com>のメール:
> 
> On Tue, Sep 12, 2017 at 4:53 AM, Takeo Ogawara <ta-ogawara@kddi-research.jp>
> wrote:
> 
>> 
>> 
>>> Is it absolutely required to query large files like this? Would it be
>>> acceptable to split the file first by making a quick scan over it?
>> No,loading large file isn’t necessarily required.
>> In fact, this large PCAP file is created by concatenating small PCAP files
>> with mergecap command.
>> So there is no problem with input small PCAP files into Drill.
>> 
>> How can I analyze numbers of PCAP files together?
>> 
> 
> Simply specify a directory instead of a file. If the directory contains
> PCAP files, then you will query those files as if they are one table.
> 
> You can also specify wildcard to allow you to query just some files.



Mime
View raw message