Splunk Enterprise

Check if a particular file exists inside a tar file

BasicLearner
Loves-to-Learn Everything

I have field with filename  containing .tgz file. I need to check if a particular file example XYZ exists inside this .tgz file.
 How can I do this?

Thanks in advance.

 

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Yes, as said on previous reply, there is no "direct" splunk command to do this task.

you have to write a custom command..

Better idea, as i did in my previous project, for downloading weekly GeoLite files, i ran a shell script which does these tasks inside(tar command got the options:

/bin/tar -zxvf /opt/splunk/fullpath/GeoLite2-City-Latest.tgz -C /opt/splunk/etc/apps/somepath/local/ --strip-components=1 GeoLite2-City_*/GeoLite2-City.mmdb

) and the script output can be fed to splunk. the shell script can be run by cronjob on required intervals..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

BasicLearner
Loves-to-Learn Everything

Hi inventsekar,

Thank you for your inputs. Need to try the shell script option.

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @BasicLearner ,.. as you "almost" got your answer, maybe you could "accept as solution" the previous reply, so that this post will become an answered post and i will get my 2 cents as well 😉

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Write a custom command that does the equivalent of 

tar -ztf $1 | grep $2

This assumes the tarball is on the local search head.

IOW, Splunk does not have this functionality built-in.

---
If this reply helps you, Karma would be appreciated.

BasicLearner
Loves-to-Learn Everything

Sorry this did not help me find the solution.

 

0 Karma

BasicLearner
Loves-to-Learn Everything

Hi Richgalloway,

Thank you for the information. Need to try more of these options. I am still new to splunk.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...