topic Re: Zip files not getting indexed in Getting Data In

Zip files not getting indexed

lohit — Tue, 31 Dec 2013 08:47:52 GMT

Hi ,

I am trying to index Vulnerbility Scanner reports in Splunk. I have configured my Vulnerbility Scanner to store the reports in a location D:\reports. So it creates files in directories like D:\reports\abc.zip\1\en\vulnerability.csv. Everytime scanner will run it willl log a report in D:\reports\ .So that means in abc.zip\1\en\vulnerability.csv only the zip file name will change.So i have configured the following in inputs.conf

[monitor://D:\reports\...\vulnerability.csv]
initCrcLength = 1024(changed it because reports have common headers)
crcSalt = <SOURCE>
disabled = false

But i am not able to see the files being indexed.

pls help !!

Re: Zip files not getting indexed

lohit — Tue, 31 Dec 2013 09:51:33 GMT

Not sure where the path seperator() went in my question.

😧 reports abc.zip 1 vulnerability.csv..

PLs consider each space with a ()

Re: Zip files not getting indexed

Ayn — Tue, 31 Dec 2013 09:54:57 GMT

Splunk doesn't treat zip files as directories (because they aren't), so doing ... in your monitor statement won't make Splunk open your zip files and recurse into them. Easiest would be to just index the whole zip.

Re: Zip files not getting indexed

lohit — Tue, 31 Dec 2013 10:32:35 GMT

ok ayn.. but i have to pick only a particular file in zip folder to be indexed. how to do that

Re: Zip files not getting indexed

lohit — Tue, 31 Dec 2013 10:40:22 GMT

Just to add to that , there will be multiple ZIp files in the same folder 'report'.