topic Re: Indexing 7-Zip Files. in Getting Data In

Indexing 7-Zip Files.

sthao — Wed, 13 Apr 2011 00:15:24 GMT

I am using Splunk 4.2 and would like to know if .7z files can be indexed?

I have attempted to index .7z files via the below steps, but have been unsuccessful:

Copying the crawl.conf file from ..\etc\system\default.
Placing the crawl.conf file in ..\etc\system\local.
Adding 7z to the packed_extensions_list line.
Restarting Splunk.
Re-indexing the location which holds the .7z files.

Thank you for any direction that can be given!

Re: Indexing 7-Zip Files.

gkanapathy — Wed, 13 Apr 2011 01:15:03 GMT

No. Splunk has configurations for gzip, bz2, and compress files, among others, but not 7z. You could probably add support for that if you choose and install a command-line decompressor with streaming decompression by mimicking the configuration for tgz files.

Re: Indexing 7-Zip Files.

sthao — Wed, 13 Apr 2011 01:51:10 GMT

Thanks for the prompt response! I may just end up having to stick with ZIP files, instead of 7z files then.

If I were to attempt support of 7z files, where would I go to get more info on mimicking the tgz configuration/setup?

Thanks!