Getting Data In

Input gzipped csv files

hypePG
Path Finder

Hey Guys,

I found a few answers regarding my question but I'm still not sure how to handle this situation.
I want to index compressed csv files which are in a *.gz format right now.

My inputs.conf for the forwarder looks like this:

[monitor:///opt/db2/*.gz]
sourcetype = db2:logs
index = db2
followTail = 0

Following the documentation here http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories#How_Splunk_Enterp... Splunk is able to index compressed files and is decompressing them while indexing. Do I understand this correctly that in this case no more configuration is needed?

The invalid_cause, unarchive_cmd and unarchive_sourcetype options in the props.conf are making me unsure about that.
If i still have to use them, do they need to be on the indexer or aswell in the forwarder app?

Thanks for getting things straight.

Regards

0 Karma

hethaishibk
New Member

For sourcetype "db2:logs" is there any configuration required.., Should we have to mention anything for index extraction

0 Karma

woodcock
Esteemed Legend

Ditch the followTail setting and you are good-to-go. You do not need to configure the unarchiving for *.gz files; Splunk knows what to do for those.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...