Splunk Enterprise

Check if a particular file exists inside a tar file

BasicLearner
Loves-to-Learn Everything

I have field with filename  containing .tgz file. I need to check if a particular file example XYZ exists inside this .tgz file.
 How can I do this?

Thanks in advance.

 

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Yes, as said on previous reply, there is no "direct" splunk command to do this task.

you have to write a custom command..

Better idea, as i did in my previous project, for downloading weekly GeoLite files, i ran a shell script which does these tasks inside(tar command got the options:

/bin/tar -zxvf /opt/splunk/fullpath/GeoLite2-City-Latest.tgz -C /opt/splunk/etc/apps/somepath/local/ --strip-components=1 GeoLite2-City_*/GeoLite2-City.mmdb

) and the script output can be fed to splunk. the shell script can be run by cronjob on required intervals..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

BasicLearner
Loves-to-Learn Everything

Hi inventsekar,

Thank you for your inputs. Need to try the shell script option.

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @BasicLearner ,.. as you "almost" got your answer, maybe you could "accept as solution" the previous reply, so that this post will become an answered post and i will get my 2 cents as well 😉

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Write a custom command that does the equivalent of 

tar -ztf $1 | grep $2

This assumes the tarball is on the local search head.

IOW, Splunk does not have this functionality built-in.

---
If this reply helps you, Karma would be appreciated.

BasicLearner
Loves-to-Learn Everything

Sorry this did not help me find the solution.

 

0 Karma

BasicLearner
Loves-to-Learn Everything

Hi Richgalloway,

Thank you for the information. Need to try more of these options. I am still new to splunk.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...