topic Indexing gz tar csv files in Splunk Dev https://community.splunk.com/t5/Splunk-Dev/Indexing-gz-tar-csv-files/m-p/347823#M5482 <P>Hello<BR /> I have a gz file that has tar file inside ( unfortunately without .tar extension though ), finally tar contains csv file<BR /> What would be a correct way to make Splunk to index that csv?<BR /> Splunk indeed opens gz file but here I have several levels of nesting ....<BR /> I also noticed that when Splunk is instructed to read a folder containing csv files, it ignores csv header that each csv has and then field can't be referenced by name, is there a way to avoid it? <BR /> Thank you</P> Tue, 13 Mar 2018 17:15:36 GMT ngm 2018-03-13T17:15:36Z Indexing gz tar csv files https://community.splunk.com/t5/Splunk-Dev/Indexing-gz-tar-csv-files/m-p/347823#M5482 <P>Hello<BR /> I have a gz file that has tar file inside ( unfortunately without .tar extension though ), finally tar contains csv file<BR /> What would be a correct way to make Splunk to index that csv?<BR /> Splunk indeed opens gz file but here I have several levels of nesting ....<BR /> I also noticed that when Splunk is instructed to read a folder containing csv files, it ignores csv header that each csv has and then field can't be referenced by name, is there a way to avoid it? <BR /> Thank you</P> Tue, 13 Mar 2018 17:15:36 GMT https://community.splunk.com/t5/Splunk-Dev/Indexing-gz-tar-csv-files/m-p/347823#M5482 ngm 2018-03-13T17:15:36Z Re: Indexing gz tar csv files https://community.splunk.com/t5/Splunk-Dev/Indexing-gz-tar-csv-files/m-p/347824#M5483 <P>Hey ngm,</P> <P>You can add this parameter to your props.conf to check header<BR /> CHECK_FOR_HEADER = [true]<BR /> HEADER_FIELD_LINE_NUMBER = 1 (to specify the line number of the header)</P> <P>You can refer this link:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A></P> <P>Let me know if this helps!!</P> Tue, 29 Sep 2020 18:28:47 GMT https://community.splunk.com/t5/Splunk-Dev/Indexing-gz-tar-csv-files/m-p/347824#M5483 deepashri_123 2020-09-29T18:28:47Z