How to ingest only a specific file type within a tar.gz?

[thisissplunk]

I've got a ton of tar.gz's to ingest. Each one has three files in it, with one "results.txt" file that actually needs to be ingested. Can I/How do I tell Splunk to read those archives but only ingest the "results.txt" csv file within it?

I have a feeling I'll need to decompress everything and add the parent file name or something onto reach "results.txt" but I'm trying really hard to avoid that.

I understand inputs.conf, but I'm pretty sure I can only point Splunk to ingest the tar.gz files, not the files within the archives.

[bcyates]

You can set a whitelist in your input stanza to only include files that read "results.txt" in the file name but if it's just one csv that you're interested in, it may be easier to untar and just upload the csv as a lookup table