Hello, I develop my own Splunk App for specific file.
These files are archive files with the ".tar.gz" extension and the filename end with "myapp". I make my own props.conf in my App :
[preprocess-myapparchive]
invalid_cause = archive
is_valid = False
LEARN_MODEL = false
[source::...myapp.tar.gz]
unarchive_cmd = /opt/splunk/etc/apps/myapp/bin/myapp.py
NO_BINARY_CKECK = true
sourcetype = preprocess-myapparchive
priority = 10002
It seems like my [source::...myapp.tar.gz] stanza is never called because Splunk catch the file as .tar.gz and try to uncompress the archive file. How i can bypass the splunk system configuration for .tar.gz files ?
My problem is relative to this post : https://community.splunk.com/t5/Getting-Data-In/ArchiveProcessor-Bypassing-normal-system-local-props...but the answer provided is not correct with my needs as I can't modify the /system/local/props.conf file...
