Can Splunk read Bluecoat logs formatted and compressed as .log.gz.done file type?

[BunnyHop]

Rather than forwarding logs from the proxy server (Bluecoat), I would ideally like to see a SplunkLWF on a server that hosts the compressed bluecoat logs. Question is, would SplunkLWF see the contents of a .log.gz.done (which is what Bluecoat Reporter (BC's logging software) renamed the compressed file)?

[gkanapathy · Accepted solution]

By default, it will not. However, if it really is a gzip file that can be uncompressed with gzip -d, then you can get Splunk to treat it the same as .gz files by adding to props.conf:

[source::....gz.done]
unarchive_cmd = gzip -cd -
sourcetype = preprocess-gzip
NO_BINARY_CHECK = true

[thambisetty]

its fine if we are monitoring in linux. what about windows? In windows unarchive_cmd=gzip -cd - will not work.

[Brian_Osburn]

Splunk handles .gz just fine - it'll unzip it and index it.

[BunnyHop]

That part is clear. However, Bluecoat has the function to rename the .gz file to .gz.done to differentiate the ones it has already processed. Would this be an issue?