fschange and indexing gzip files

joonradley — Mon, 08 Nov 2010 22:03:05 GMT

I am using fschange to monitor some gziped files.

When the full event is loaded it is index as binary gzip and not ASCII.

Is there a way to indexes the files as ASCII?

Unfortunately the files are only in gzip and we cannot use monitor.

Re: fschange and indexing gzip files

jbsplunk — Sat, 20 Nov 2010 02:50:47 GMT

There is not a way to tell fschange to index the files in another method. However, you can call props.conf to tell it to uncompress files. You'd do something like this:

[your sourcetype] CHARSET = SHIFT-JIS NO_BINARY_CHECK = true

[source::D:\samplelogcompressed\test\*(?

For details see:

http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

topic fschange and indexing gzip files in Getting Data In

fschange and indexing gzip files

Re: fschange and indexing gzip files