Input gzipped csv files

hypePG — Tue, 29 Sep 2020 13:09:20 GMT

Hey Guys,

I found a few answers regarding my question but I'm still not sure how to handle this situation.
I want to index compressed csv files which are in a *.gz format right now.

My inputs.conf for the forwarder looks like this:

[monitor:///opt/db2/*.gz]
sourcetype = db2:logs
index = db2
followTail = 0

Following the documentation here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_Splunk_Enterprise_monitors_archived_files Splunk is able to index compressed files and is decompressing them while indexing. Do I understand this correctly that in this case no more configuration is needed?

The invalid_cause, unarchive_cmd and unarchive_sourcetype options in the props.conf are making me unsure about that.
If i still have to use them, do they need to be on the indexer or aswell in the forwarder app?

Thanks for getting things straight.

Regards

Re: Input gzipped csv files

woodcock — Thu, 09 Mar 2017 15:37:13 GMT

Ditch the followTail setting and you are good-to-go. You do not need to configure the unarchiving for *.gz files; Splunk knows what to do for those.

Re: Input gzipped csv files

hethaishibk — Wed, 10 Apr 2019 09:07:35 GMT

For sourcetype "db2:logs" is there any configuration required.., Should we have to mention anything for index extraction

topic Re: Input gzipped csv files in Getting Data In

Input gzipped csv files

Re: Input gzipped csv files

Re: Input gzipped csv files