topic Re: How can I read a tgz file into Splunk? in Getting Data In

How can I read a tgz file into Splunk?

sdse78 — Sat, 13 Aug 2016 17:50:29 GMT

According to a book (Splunk Essentials By: Betsy Page Sigman) I recently read on Splunk, Splunk can read in data from basically all types of files containing clear data, or as they put it, any data. Splunk can also decompress the following types of files: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z along with many other formats. If this is true, how does it decompress the data? Specifically, if I am using "Add Data" within the manager can it first decompress a tgz file and then input it or do I need to decompress it first?

I have a tgz file I am trying to input that is 1.08GB in size. However, every time I browse to it and try to input the file I get a message that the file is over 500MB and Splunk will not accept it.

Can someone here help me solve this problem?

Re: How can I read a tgz file into Splunk?

esix_splunk — Sun, 14 Aug 2016 03:18:42 GMT

Splunk has the built in capability to un-zip/tar/z files. However, the GUI is limited, as it says, to files that are 500mb. That means, you cannot upload a file that is over 500mg.

You will need to use oneshot, or setup a monitor on the file to ingest it into Splunk. You should read here : http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/MonitorfilesanddirectoriesusingtheCLI . That describes everything you need to do to get your large tgz file ingested into Splunk.

Re: How can I read a tgz file into Splunk?

sdse78 — Sun, 14 Aug 2016 20:56:01 GMT

I'm having issues with the link your provided.

Re: How can I read a tgz file into Splunk?

Richfez — Mon, 15 Aug 2016 00:01:05 GMT

I fixed the link in esix's answer. The editor decided the period at the end of the sentence was part of the URL, so I added a space and now it works.

Re: How can I read a tgz file into Splunk?

sdse78 — Mon, 15 Aug 2016 00:12:55 GMT

Thank you rich7177. I greatly appreciate it.