https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-only-a-specific-file-type-within-a-tar-gz/m-p/326528#M60696 <P>You can set a whitelist in your input stanza to only include files that read "results.txt" in the file name but if it's just one csv that you're interested in, it may be easier to untar and just upload the csv as a lookup table</P> Thu, 01 Mar 2018 20:45:41 GMT bcyates 2018-03-01T20:45:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-only-a-specific-file-type-within-a-tar-gz/m-p/326527#M60695 <P>I've got a ton of tar.gz's to ingest. Each one has three files in it, with one "results.txt" file that actually needs to be ingested. Can I/How do I tell Splunk to read those archives but only ingest the "results.txt" csv file within it?</P> <P>I have a feeling I'll need to decompress everything and add the parent file name or something onto reach "results.txt" but I'm trying really hard to avoid that.</P> <P>I understand inputs.conf, but I'm pretty sure I can only point Splunk to ingest the tar.gz files, not the files within the archives.</P> Thu, 01 Mar 2018 17:38:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-only-a-specific-file-type-within-a-tar-gz/m-p/326527#M60695 thisissplunk 2018-03-01T17:38:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-only-a-specific-file-type-within-a-tar-gz/m-p/326528#M60696 <P>You can set a whitelist in your input stanza to only include files that read "results.txt" in the file name but if it's just one csv that you're interested in, it may be easier to untar and just upload the csv as a lookup table</P> Thu, 01 Mar 2018 20:45:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-only-a-specific-file-type-within-a-tar-gz/m-p/326528#M60696 bcyates 2018-03-01T20:45:41Z