Getting Data In

Index zip files with hierarchical folder structure

thirumalreddyb
Communicator

I have a folder with plenty of zip files. Every zip is a zipped folder with folder inside a folder and the deepest folder contains an XML file.

The zip contains file like this;
ZipFolder > src > log > 20160605183045.xml.

The zip files are present in the below location,
D:\BrowniesApp\Logs[zip files present here]

Tags (4)
0 Karma

woodcock
Esteemed Legend

You are going to have to unzip these to get them to work. You would eventually decide to do this anyway because the Archiving Queue is processed with a single-thread which means that it takes FOREVER to forward zip files and it almost always has backups leading to BIG problems. The only solution is to unzip them or install multiple instances of Splunk and partition the sets of files. So setup a cron job to unzip them and copy them somewhere else and have Splunk monitor that other directory (perhaps in batch mode to delete them once forwarded).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...