Check if a particular file exists inside a tar file

[BasicLearner]

I have field with filename  containing .tgz file. I need to check if a particular file example XYZ exists inside this .tgz file.
 How can I do this?

Thanks in advance.

[inventsekar]

Yes, as said on previous reply, there is no "direct" splunk command to do this task.

you have to write a custom command..

Better idea, as i did in my previous project, for downloading weekly GeoLite files, i ran a shell script which does these tasks inside(tar command got the options:

/bin/tar -zxvf /opt/splunk/fullpath/GeoLite2-City-Latest.tgz -C /opt/splunk/etc/apps/somepath/local/ --strip-components=1 GeoLite2-City_*/GeoLite2-City.mmdb

) and the script output can be fed to splunk. the shell script can be run by cronjob on required intervals..

[BasicLearner]

Hi inventsekar,

Thank you for your inputs. Need to try the shell script option.

[inventsekar]

Hi @BasicLearner ,.. as you "almost" got your answer, maybe you could "accept as solution" the previous reply, so that this post will become an answered post and i will get my 2 cents as well 😉

[richgalloway]

Write a custom command that does the equivalent of 

tar -ztf $1 | grep $2

This assumes the tarball is on the local search head.

IOW, Splunk does not have this functionality built-in.

[BasicLearner]

Sorry this did not help me find the solution.

[BasicLearner]

Hi Richgalloway,

Thank you for the information. Need to try more of these options. I am still new to splunk.