Zip files not getting indexed

[lohit]

Hi ,

I am trying to index Vulnerbility Scanner reports in Splunk. I have configured my Vulnerbility Scanner to store the reports in a location D:\reports. So it creates files in directories like D:\reports\abc.zip\1\en\vulnerability.csv. Everytime scanner will run it willl log a report in D:\reports\ .So that means in abc.zip\1\en\vulnerability.csv only the zip file name will change.So i have configured the following in inputs.conf

[monitor://D:\reports\...\vulnerability.csv]
initCrcLength = 1024(changed it because reports have common headers)
crcSalt = <SOURCE>
disabled = false

But i am not able to see the files being indexed.

pls help !!

[Ayn]

Splunk doesn't treat zip files as directories (because they aren't), so doing ... in your monitor statement won't make Splunk open your zip files and recurse into them. Easiest would be to just index the whole zip.

[lohit]

Just to add to that , there will be multiple ZIp files in the same folder 'report'.

[lohit]

ok ayn.. but i have to pick only a particular file in zip folder to be indexed. how to do that

[lohit]

Not sure where the path seperator() went in my question.

😧 reports abc.zip 1 vulnerability.csv..

PLs consider each space with a ()