fschange and indexing gzip files

[joonradley]

I am using fschange to monitor some gziped files.

When the full event is loaded it is index as binary gzip and not ASCII.

Is there a way to indexes the files as ASCII?

Unfortunately the files are only in gzip and we cannot use monitor.

[jbsplunk]

There is not a way to tell fschange to index the files in another method. However, you can call props.conf to tell it to uncompress files. You'd do something like this:

[your sourcetype] CHARSET = SHIFT-JIS NO_BINARY_CHECK = true

[source::D:\samplelogcompressed\test\*(?

For details see:

http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf