Deployment Architecture

Why is an AWS S3 Bucket with .zip Files not getting indexed in Splunk Cloud?

New Member

I'm a bit of a noob so any help here would be greatly appreciated.

I have buckets in S3 with .log files contained in .zip files. For some season Splunk (Splunk Cloud) isn't extracting the .zip files and indexing the contained .log files. Any ideas why this would be? When I upload one of the .log files within a .zip file individually it gets indexed beautifully. It was my understanding that Splunk should have no problem indexing files within .zip files.

Thanks in advance!

Tags (5)
0 Karma

New Member

According to Splunk doc, it just does not support .zip file on S3 bucket. Refer to the list of supported compressed file format at #4 about this:
http://docs.splunk.com/Documentation/AddOns/released/AWS/ConfigureInputs#S3_inputs

0 Karma

Splunk Employee
Splunk Employee

Validate your inputs, and make sure that the .zip files are not blacklisted. Most likely they are due to processing and member requirements associated with un/archiving files in the queues.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!