Bypassing normal system/local/props.conf processing for .tar.gz files

adrienG — Wed, 14 Oct 2020 07:33:35 GMT

Hello, I develop my own Splunk App for specific file.

These files are archive files with the ".tar.gz" extension and the filename end with "myapp". I make my own props.conf in my App :

[preprocess-myapparchive] invalid_cause = archive is_valid = False LEARN_MODEL = false [source::...myapp.tar.gz] unarchive_cmd = /opt/splunk/etc/apps/myapp/bin/myapp.py NO_BINARY_CKECK = true sourcetype = preprocess-myapparchive priority = 10002

It seems like my [source::...myapp.tar.gz] stanza is never called because Splunk catch the file as .tar.gz and try to uncompress the archive file. How i can bypass the splunk system configuration for .tar.gz files ?

My problem is relative to this post : https://community.splunk.com/t5/Getting-Data-In/ArchiveProcessor-Bypassing-normal-system-local-props-conf/m-p/78002#M15965 but the answer provided is not correct with my needs as I can't modify the /system/local/props.conf file...

topic Bypassing normal system/local/props.conf processing for .tar.gz files in Getting Data In

Bypassing normal system/local/props.conf processing for .tar.gz files