Getting Data In

Index zip files with hierarchical folder structure

thirumalreddyb
Communicator

I have a folder with plenty of zip files. Every zip is a zipped folder with folder inside a folder and the deepest folder contains an XML file.

The zip contains file like this;
ZipFolder > src > log > 20160605183045.xml.

The zip files are present in the below location,
D:\BrowniesApp\Logs[zip files present here]

Tags (4)
0 Karma

woodcock
Esteemed Legend

You are going to have to unzip these to get them to work. You would eventually decide to do this anyway because the Archiving Queue is processed with a single-thread which means that it takes FOREVER to forward zip files and it almost always has backups leading to BIG problems. The only solution is to unzip them or install multiple instances of Splunk and partition the sets of files. So setup a cron job to unzip them and copy them somewhere else and have Splunk monitor that other directory (perhaps in batch mode to delete them once forwarded).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...