drill-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ted Dunning <ted.dunn...@gmail.com>
Subject Re: ***UNCHECKED*** Re: Query Error on PCAP over MapR FS
Date Tue, 12 Sep 2017 10:16:14 GMT
Don't thank me.  Thank the Drill community that made that work!



On Tue, Sep 12, 2017 at 6:03 AM, Takeo Ogawara <ta-ogawara@kddi-research.jp>
wrote:

> Query on directory and wildcard works well!
> Thank you so much.
>
> > 2017/09/12 12:13、Ted Dunning <ted.dunning@gmail.com>のメール:
> >
> > On Tue, Sep 12, 2017 at 4:53 AM, Takeo Ogawara <
> ta-ogawara@kddi-research.jp>
> > wrote:
> >
> >>
> >>
> >>> Is it absolutely required to query large files like this? Would it be
> >>> acceptable to split the file first by making a quick scan over it?
> >> No,loading large file isn’t necessarily required.
> >> In fact, this large PCAP file is created by concatenating small PCAP
> files
> >> with mergecap command.
> >> So there is no problem with input small PCAP files into Drill.
> >>
> >> How can I analyze numbers of PCAP files together?
> >>
> >
> > Simply specify a directory instead of a file. If the directory contains
> > PCAP files, then you will query those files as if they are one table.
> >
> > You can also specify wildcard to allow you to query just some files.
>
>
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message