topic Re: How to monitor and index .bz2 files in Splunk? in Getting Data In

How to monitor and index .bz2 files in Splunk?

James_ACN — Fri, 05 Nov 2021 22:46:24 GMT

Hi, All.

How to index compressed files in .bz2 format using Universal Forwarder installed on a Windows server?

In UF:

inputs.conf

[monitor://E:\LogServer\Logs\*.bz2]
sourcetype = XmlWinEventLog
disabled=0
index = main

props.conf

[source::...E:\\LogServer\\Logs\\*.bz2]
sourcetype = XmlWinEventLog

[XmlWinEventLog]
invalid_cause = archive
unarchive_cmd = _auto

According to the most recent docs Splunk does index compressed files:

https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/Propsconf

But even following these instructions, the logs are still not indexed and I was also unable to check the splunkd.log logs for any error that indicates a problem.

Does anyone have any suggestions?

Thanks in advance.

James \°/

Re: How to monitor and index .bz2 files in Splunk?

PickleRick — Sat, 06 Nov 2021 08:34:27 GMT

Never used it myself but.

unarchive_cmd = <string>
[...]
* This field is only valid on [source::<source>] stanzas.

So setting it on sourcetype should not work.

Re: How to monitor and index .bz2 files in Splunk?

James_ACN — Tue, 09 Nov 2021 12:55:59 GMT

Hi All!

I still haven't been able to solve this problem.

Does anyone have any outline suggestions?

Thanks!

James \°/