topic How to Indexed .gz file in a directory in Getting Data In

How to Indexed .gz file in a directory

ludoz13 — Fri, 14 Oct 2011 12:31:12 GMT

I have a directory with some gz file and when I add this directory, there are nothings to indexed.

In Add Data, I have chosen "Continuously index data from a file or directory this Splunk instance can access" and I have put the right path.

Splunk find the number of file but there are nothing (no new source, host or sourcetype).

Thank for your help !!!

Re: How to Indexed .gz file in a directory

Ayn — Fri, 14 Oct 2011 13:31:33 GMT

Splunk eats gzipped files without problems. Is this data completely new to Splunk or is it something that it has seen before (perhaps in another directory)? If so, you should set crcSalt = <SOURCE> for the input in inputs.conf.

Re: How to Indexed .gz file in a directory

kdenton — Fri, 14 Oct 2011 14:01:07 GMT

It can also take a bit of time for the data to show up in Splunk as Splunk looks at these files one at a time as it has to uncompresse each file and ingest it.