topic Does it affect Splunk to monitor encrypted archive data? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Does-it-affect-Splunk-to-monitor-encrypted-archive-data/m-p/433770#M75803 <P>I know that Splunk doesn't support monitoring of encrypted data.</P> <P>But I want to know what happens when Splunk tries to monitor encrypted archive data, <BR /> because I think that there is a possibility that Splunk accidentally monitored encrypted archive data when I configure dir monitoring.</P> <OL> <LI><P>In whatever form (collapsed etc.), does Splunk capture those data?</P></LI> <LI><P>Are there any effects to performance?</P></LI> <LI><P>Can I detect monitoring of encrypted data from internal log or other some information?</P></LI> </OL> <P>If someone knows about it, please tell me.</P> Tue, 11 Dec 2018 09:08:18 GMT yutaka1005 2018-12-11T09:08:18Z Does it affect Splunk to monitor encrypted archive data? https://community.splunk.com/t5/Getting-Data-In/Does-it-affect-Splunk-to-monitor-encrypted-archive-data/m-p/433770#M75803 <P>I know that Splunk doesn't support monitoring of encrypted data.</P> <P>But I want to know what happens when Splunk tries to monitor encrypted archive data, <BR /> because I think that there is a possibility that Splunk accidentally monitored encrypted archive data when I configure dir monitoring.</P> <OL> <LI><P>In whatever form (collapsed etc.), does Splunk capture those data?</P></LI> <LI><P>Are there any effects to performance?</P></LI> <LI><P>Can I detect monitoring of encrypted data from internal log or other some information?</P></LI> </OL> <P>If someone knows about it, please tell me.</P> Tue, 11 Dec 2018 09:08:18 GMT https://community.splunk.com/t5/Getting-Data-In/Does-it-affect-Splunk-to-monitor-encrypted-archive-data/m-p/433770#M75803 yutaka1005 2018-12-11T09:08:18Z Re: Does it affect Splunk to monitor encrypted archive data? https://community.splunk.com/t5/Getting-Data-In/Does-it-affect-Splunk-to-monitor-encrypted-archive-data/m-p/433771#M75804 <P>検証してみました。</P> <P>以下のようなログを出力して処理を終了するだけです。</P> <PRE><CODE>INFO ArchiveProcessor - Finished processing file 'XXX.zip', removing from stats </CODE></PRE> <P>TailProcessorは対象となったファイルを再び監視し、更新日が変更されれば再度同じ処理を行います。<BR /> list monitorすれば監視対象としてZIPファイルが表示されます。読めないファイルを監視するので無駄といえば無駄ですが、その程度のことです。数ファイル、３時間程度での検証ですがリソースの増加も認められませんでした。</P> Tue, 11 Dec 2018 12:01:45 GMT https://community.splunk.com/t5/Getting-Data-In/Does-it-affect-Splunk-to-monitor-encrypted-archive-data/m-p/433771#M75804 HiroshiSatoh 2018-12-11T12:01:45Z