Indexing ZIP files

efelder0 · ‎07-16-2012

Can Splunk index gzip/zip files (flat-file format)?

hurricanelabs · ‎12-18-2015

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_Splunk_Enterp...

Ayn · ‎07-16-2012

Yes.

http://splunk-base.splunk.com/answers/279/does-splunk-index-gzip-files

dwaddle · ‎07-16-2012

Pedantic reminder that "zip" != "gzip". One of these (.zip) is the venerable PKZIP format that allows multiple files within an archive. The other (.gz) is the gzip single-file compression format.

Ayn · ‎07-16-2012

Nope! It indexes it right out of the box.

efelder0 · ‎07-16-2012

props.conf, transforms.conf

efelder0 · ‎07-16-2012

OK, good. Are there config changes that need to occur?

Indexing ZIP files

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Indexing ZIP files

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas