Getting Data In

fschange and indexing gzip files

joonradley
Path Finder

I am using fschange to monitor some gziped files.

When the full event is loaded it is index as binary gzip and not ASCII.

Is there a way to indexes the files as ASCII?

Unfortunately the files are only in gzip and we cannot use monitor.

Tags (3)

jbsplunk
Splunk Employee
Splunk Employee

There is not a way to tell fschange to index the files in another method. However, you can call props.conf to tell it to uncompress files. You'd do something like this:

[your sourcetype] CHARSET = SHIFT-JIS NO_BINARY_CHECK = true

[source::D:\samplelogcompressed\test\*(?

For details see:

http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!