Getting Data In

Input gzipped csv files

Path Finder

Hey Guys,

I found a few answers regarding my question but I'm still not sure how to handle this situation.
I want to index compressed csv files which are in a *.gz format right now.

My inputs.conf for the forwarder looks like this:

sourcetype = db2:logs
index = db2
followTail = 0

Following the documentation here Splunk is able to index compressed files and is decompressing them while indexing. Do I understand this correctly that in this case no more configuration is needed?

The invalid_cause, unarchive_cmd and unarchive_sourcetype options in the props.conf are making me unsure about that.
If i still have to use them, do they need to be on the indexer or aswell in the forwarder app?

Thanks for getting things straight.


0 Karma

New Member

For sourcetype "db2:logs" is there any configuration required.., Should we have to mention anything for index extraction

0 Karma

Esteemed Legend

Ditch the followTail setting and you are good-to-go. You do not need to configure the unarchiving for *.gz files; Splunk knows what to do for those.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...