Splunk Dev

Indexing gz tar csv files

ngm
New Member

Hello
I have a gz file that has tar file inside ( unfortunately without .tar extension though ), finally tar contains csv file
What would be a correct way to make Splunk to index that csv?
Splunk indeed opens gz file but here I have several levels of nesting ....
I also noticed that when Splunk is instructed to read a folder containing csv files, it ignores csv header that each csv has and then field can't be referenced by name, is there a way to avoid it?
Thank you

Tags (1)
0 Karma

deepashri_123
Motivator

Hey ngm,

You can add this parameter to your props.conf to check header
CHECK_FOR_HEADER = [true]
HEADER_FIELD_LINE_NUMBER = 1 (to specify the line number of the header)

You can refer this link:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Let me know if this helps!!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...