Splunk indexing zipped file without extracting or reading contents

padgetts — Wed, 16 Sep 2020 10:33:03 GMT

I am trying to make a Splunk index a zipped file that is generated every hour.

I use the batch method in order to destroy the file once it has been dealt with however i do not want Splunk to read the contents of the file but rather just index the actual zipped information for archival purposes.

Then if i require it in the future i can extract it at a later date.

I have looked into the props.conf (invalid_cause) method but it seems to extract the zipped file before indexing or not at all (errors).

Does anyone have experience or advice with this?

Re: Splunk indexing zipped file without extracting or reading contents

richgalloway — Wed, 16 Sep 2020 12:30:14 GMT

That's not really what Splunk is for. Since zipped files are not text, Splunk will not index them in native form. After all, the point of Splunk is to have your data available for searching and a zipped file is not searchable.

Instead, consider copying the zip file to an AWS S3 bucket for archival.

topic Re: Splunk indexing zipped file without extracting or reading contents in Getting Data In

Splunk indexing zipped file without extracting or reading contents

Re: Splunk indexing zipped file without extracting or reading contents