Getting Data In

fschange and indexing gzip files

Path Finder

I am using fschange to monitor some gziped files.

When the full event is loaded it is index as binary gzip and not ASCII.

Is there a way to indexes the files as ASCII?

Unfortunately the files are only in gzip and we cannot use monitor.

Tags (3)

Splunk Employee
Splunk Employee

There is not a way to tell fschange to index the files in another method. However, you can call props.conf to tell it to uncompress files. You'd do something like this:

[your sourcetype] CHARSET = SHIFT-JIS NO_BINARY_CHECK = true


For details see:

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!