topic Re: Check if a particular file exists inside a tar file in Splunk Enterprise

Check if a particular file exists inside a tar file

BasicLearner — Wed, 05 Jan 2022 22:17:19 GMT

I have field with filename containing .tgz file. I need to check if a particular file example XYZ exists inside this .tgz file.
How can I do this?

Thanks in advance.

Re: Check if a particular file exists inside a tar file

richgalloway — Thu, 06 Jan 2022 01:18:40 GMT

Write a custom command that does the equivalent of

tar -ztf $1 | grep $2

This assumes the tarball is on the local search head.

IOW, Splunk does not have this functionality built-in.

Re: Check if a particular file exists inside a tar file

inventsekar — Thu, 06 Jan 2022 02:02:50 GMT

Yes, as said on previous reply, there is no "direct" splunk command to do this task.

you have to write a custom command..

Better idea, as i did in my previous project, for downloading weekly GeoLite files, i ran a shell script which does these tasks inside(tar command got the options:

/bin/tar -zxvf /opt/splunk/fullpath/GeoLite2-City-Latest.tgz -C /opt/splunk/etc/apps/somepath/local/ --strip-components=1 GeoLite2-City_*/GeoLite2-City.mmdb

) and the script output can be fed to splunk. the shell script can be run by cronjob on required intervals..

Re: Check if a particular file exists inside a tar file

BasicLearner — Thu, 06 Jan 2022 09:59:30 GMT

Hi inventsekar,

Thank you for your inputs. Need to try the shell script option.

Re: Check if a particular file exists inside a tar file

BasicLearner — Thu, 06 Jan 2022 10:00:30 GMT

Hi Richgalloway,

Thank you for the information. Need to try more of these options. I am still new to splunk.

Re: Check if a particular file exists inside a tar file

inventsekar — Thu, 06 Jan 2022 13:55:23 GMT

Hi @BasicLearner ,.. as you "almost" got your answer, maybe you could "accept as solution" the previous reply, so that this post will become an answered post and i will get my 2 cents as well 😉

Re: Check if a particular file exists inside a tar file

BasicLearner — Mon, 10 Jan 2022 09:45:39 GMT

Sorry this did not help me find the solution.