topic Re: Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type? in Deployment Architecture

Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

BunnyHop — Sat, 30 Oct 2010 00:51:21 GMT

Rather than forwarding logs from the proxy server (Bluecoat), I would ideally like to see a SplunkLWF on a server that hosts the compressed bluecoat logs. Question is, would SplunkLWF see the contents of a .log.gz.done (which is what Bluecoat Reporter (BC's logging software) renamed the compressed file)?

Re: Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

Brian_Osburn — Sat, 30 Oct 2010 01:25:54 GMT

Splunk handles .gz just fine - it'll unzip it and index it.

Re: Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

BunnyHop — Sat, 30 Oct 2010 03:30:46 GMT

That part is clear. However, Bluecoat has the function to rename the .gz file to .gz.done to differentiate the ones it has already processed. Would this be an issue?

Re: Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

gkanapathy — Sat, 30 Oct 2010 04:13:46 GMT

By default, it will not. However, if it really is a gzip file that can be uncompressed with gzip -d, then you can get Splunk to treat it the same as .gz files by adding to props.conf:

[source::....gz.done]
unarchive_cmd = gzip -cd -
sourcetype = preprocess-gzip
NO_BINARY_CHECK = true

Re: Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

thambisetty — Mon, 13 Apr 2015 09:02:58 GMT

its fine if we are monitoring in linux. what about windows? In windows unarchive_cmd=gzip -cd - will not work.