All Apps and Add-ons
Highlighted

REST API option for compressed file? Can I index a zip file?

Contributor

I want to set up a REST API call to https get request but this site will return a zip file instead of xml, jason , or text. Is there a way I could set it to index the zip file? If not, is there any workaround? This is the description from the site:

alt text

0 Karma
Highlighted

Re: REST API option for compressed file? Can I index a zip file?

Ultra Champion

You can try using a custom response handler that will unzip the file for you.

  • Create a custom handler in $SPLUNKHOME/etc/apps/restta/bin/responsehandlers.py
  • Declare the handler in your configuration

Psuedo code examples :

alt text

alt text

View solution in original post

Highlighted

Re: REST API option for compressed file? Can I index a zip file?

Splunk Employee
Splunk Employee

Hey @tamduong16, if @damien solved your problem, please close the question and award karma points by accepting the answer. 🙂 Happy Splunking!

0 Karma