Getting Data In

Input gzipped csv files

Path Finder

Hey Guys,

I found a few answers regarding my question but I'm still not sure how to handle this situation.
I want to index compressed csv files which are in a *.gz format right now.

My inputs.conf for the forwarder looks like this:

sourcetype = db2:logs
index = db2
followTail = 0

Following the documentation here Splunk is able to index compressed files and is decompressing them while indexing. Do I understand this correctly that in this case no more configuration is needed?

The invalid_cause, unarchive_cmd and unarchive_sourcetype options in the props.conf are making me unsure about that.
If i still have to use them, do they need to be on the indexer or aswell in the forwarder app?

Thanks for getting things straight.


0 Karma

New Member

For sourcetype "db2:logs" is there any configuration required.., Should we have to mention anything for index extraction

0 Karma

Esteemed Legend

Ditch the followTail setting and you are good-to-go. You do not need to configure the unarchiving for *.gz files; Splunk knows what to do for those.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...