Getting Data In

unarchive_cmd and no indexed data



I have some binary files, which I pass through unarchive_cmd.

My props.conf:

invalid_cause = archive
unarchive_cmd = strings -8 | tr '\n' '\t' | sed 's/\([0-9]\+\t[0-9][0-9] [^\t]\+\)/\n\1/g' | cut -f 1-2
sourcetype = test_audit

Testing on my local Splunk looks good - I have results in index.
In _internal there is something like this:

03-09-2016 12:27:50.235 +0100 INFO  ArchiveProcessor - Finished processing file '/apps/sms/2016_03_07.obj', removing from stats
03-09-2016 12:27:49.579 +0100 INFO  ArchiveProcessor - reading path=/apps/sms/2016_03_07.obj (seek=0 len=166756)
03-09-2016 12:27:49.579 +0100 INFO  ArchiveProcessor - handling file=/apps/sms/2016_03_07.obj

Now I try to do the same in distributed environment:
I put this props.conf on universal forwarder (for NO_BINARY_CHECK setting), and on master cluster (then click "distribute configuration bundle to indexers).

I can read the same data in _internal, but actually no data is indexed.
What should I do, and why this doesn't work?

Tags (2)
0 Karma



Have you checked if in the indexers the configuration is replicated?

Hope help you.

0 Karma


Yes, all (both) indexers replicated this section in props.conf

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...