Getting Data In

Index zip files with hierarchical folder structure

thirumalreddyb
Communicator

I have a folder with plenty of zip files. Every zip is a zipped folder with folder inside a folder and the deepest folder contains an XML file.

The zip contains file like this;
ZipFolder > src > log > 20160605183045.xml.

The zip files are present in the below location,
D:\BrowniesApp\Logs[zip files present here]

Tags (4)
0 Karma

woodcock
Esteemed Legend

You are going to have to unzip these to get them to work. You would eventually decide to do this anyway because the Archiving Queue is processed with a single-thread which means that it takes FOREVER to forward zip files and it almost always has backups leading to BIG problems. The only solution is to unzip them or install multiple instances of Splunk and partition the sets of files. So setup a cron job to unzip them and copy them somewhere else and have Splunk monitor that other directory (perhaps in batch mode to delete them once forwarded).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...