Knowledge Management

Is this possible to simply extract the content of a journal.zst file?

GaetanVP
Contributor

Hello Splunkers, I have a quick question,

Is this possible to simply extract the content of a journal.zst file ? Is it encrypted in some way or should I be able to retrieve the whole raw data out of it ?

The journal file is located here : <index_path>/db/hot_<whatever>/rawdata/journal.zst

Thanks a lot,

GaetanVP

Get Updates on the Splunk Community!

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...