Archive

Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

BunnyHop
Contributor

Rather than forwarding logs from the proxy server (Bluecoat), I would ideally like to see a SplunkLWF on a server that hosts the compressed bluecoat logs. Question is, would SplunkLWF see the contents of a .log.gz.done (which is what Bluecoat Reporter (BC's logging software) renamed the compressed file)?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

By default, it will not. However, if it really is a gzip file that can be uncompressed with gzip -d, then you can get Splunk to treat it the same as .gz files by adding to props.conf:

[source::....gz.done]
unarchive_cmd = gzip -cd -
sourcetype = preprocess-gzip
NO_BINARY_CHECK = true

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

By default, it will not. However, if it really is a gzip file that can be uncompressed with gzip -d, then you can get Splunk to treat it the same as .gz files by adding to props.conf:

[source::....gz.done]
unarchive_cmd = gzip -cd -
sourcetype = preprocess-gzip
NO_BINARY_CHECK = true

View solution in original post

thambisetty
Super Champion

its fine if we are monitoring in linux. what about windows? In windows unarchive_cmd=gzip -cd - will not work.

————————————
If this helps, give a like below.
0 Karma

Brian_Osburn
Builder

Splunk handles .gz just fine - it'll unzip it and index it.

0 Karma

BunnyHop
Contributor

That part is clear. However, Bluecoat has the function to rename the .gz file to .gz.done to differentiate the ones it has already processed. Would this be an issue?

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on