Getting Data In

Indexing 7-Zip Files.

New Member

I am using Splunk 4.2 and would like to know if .7z files can be indexed?

I have attempted to index .7z files via the below steps, but have been unsuccessful:

  1. Copying the crawl.conf file from ..\etc\system\default.
  2. Placing the crawl.conf file in ..\etc\system\local.
  3. Adding 7z to the packed_extensions_list line.
  4. Restarting Splunk.
  5. Re-indexing the location which holds the .7z files.

Thank you for any direction that can be given!

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

No. Splunk has configurations for gzip, bz2, and compress files, among others, but not 7z. You could probably add support for that if you choose and install a command-line decompressor with streaming decompression by mimicking the configuration for tgz files.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

No. Splunk has configurations for gzip, bz2, and compress files, among others, but not 7z. You could probably add support for that if you choose and install a command-line decompressor with streaming decompression by mimicking the configuration for tgz files.

View solution in original post

0 Karma

New Member

Thanks for the prompt response! I may just end up having to stick with ZIP files, instead of 7z files then.

If I were to attempt support of 7z files, where would I go to get more info on mimicking the tgz configuration/setup?

Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!