Monitor file names with regex - is it a best practice?

[vdevarayan]

I am looking for best practice to monitor a bunch of files - whose names i dont know.
For example, my report directory's home is
/path/to/dir/report/1/result.zip
/path/to/dir/report/2/result.zip
/path/to/dir/report/3/result.zip
...

Is it correct to specify a regex like this in the inputs.conf and recommended?
/path/to/dir/report/[0-9]+/result.zip

Also, does splunk handle zip files?

[satishsdange · Accepted solution]

Hi -

Splunk can index zip files. Splunk automatically extracts important fields from raw data. Examples provides by you could be seen in source field in Splunk console.

I would recommend you go through Splunk search tutorial -
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial

Hope this helps.

[satishsdange]

Hi @vdevarayan - Please accept the answer and vote if above response helped you.