- CSV files
Squey is able to load any CSV file(s) that does not contain new lines in fields.
Click on the Local files... button located on the SOURCES section of the start page and browse your dataset.
Note that .zip, .gz, .bz2 or .xz compressed dataset are supported and will by decompressed on the fly.
The file format and column types will be automatically detected, so just click Yes.
If your CSV file is containing a header with the name of the columns, it will be automatically detected and used.
- PCAP files
Click on the Pcap... button under the SOURCES section of the start page.
Then click on the Manage profiles button.
Click on New profile, enter the profile name of your choice and click Ok.
Then click Select and browse one of the PCAP of the dataset to load the various protocols it contains.
Lets now choose the packet fields we would like to be able to use in our analysis. Almost all fields supported by Wireshark are available, but keep in mind that the more fields you choose, the slower the packet captures will be loading and the bigger the space in RAM will also be.
- Structured text files
Unlink loading CSV files, structured text files requires a bit more up-front work using regular expressions.
Crafting the regular expression Click on the Create a new format... button located on the start page
and then add a RegExp splitter by clicking the Splitters > add RegExp Splitter menus.
Enter your regular expression and validate its relevance by loading a sample of your dataset.
Tip: to validate your regular expression piece by piece, you can temporarily finish it by (.