Getting Data In

Zip files not getting indexed

lohit
Path Finder

Hi ,

I am trying to index Vulnerbility Scanner reports in Splunk. I have configured my Vulnerbility Scanner to store the reports in a location D:\reports. So it creates files in directories like D:\reports\abc.zip\1\en\vulnerability.csv. Everytime scanner will run it willl log a report in D:\reports\ .So that means in abc.zip\1\en\vulnerability.csv only the zip file name will change.So i have configured the following in inputs.conf

[monitor://D:\reports\...\vulnerability.csv]
initCrcLength = 1024(changed it because reports have common headers)
crcSalt = <SOURCE>
disabled = false

But i am not able to see the files being indexed.

pls help !!

Tags (2)
0 Karma

Ayn
Legend

Splunk doesn't treat zip files as directories (because they aren't), so doing ... in your monitor statement won't make Splunk open your zip files and recurse into them. Easiest would be to just index the whole zip.

lohit
Path Finder

Just to add to that , there will be multiple ZIp files in the same folder 'report'.

lohit
Path Finder

ok ayn.. but i have to pick only a particular file in zip folder to be indexed. how to do that

0 Karma

lohit
Path Finder

Not sure where the path seperator() went in my question.

😧 reports abc.zip 1 vulnerability.csv..

PLs consider each space with a ()

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...