I am looking for best practice to monitor a bunch of files - whose names i dont know.
For example, my report directory's home is
/path/to/dir/report/1/result.zip
/path/to/dir/report/2/result.zip
/path/to/dir/report/3/result.zip
...
Is it correct to specify a regex like this in the inputs.conf and recommended?
/path/to/dir/report/[0-9]+/result.zip
Also, does splunk handle zip files?
Hi -
Splunk can index zip files. Splunk automatically extracts important fields from raw data. Examples provides by you could be seen in source field in Splunk console.
I would recommend you go through Splunk search tutorial -
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial
Hope this helps.
Hi -
Splunk can index zip files. Splunk automatically extracts important fields from raw data. Examples provides by you could be seen in source field in Splunk console.
I would recommend you go through Splunk search tutorial -
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial
Hope this helps.
Hi @vdevarayan - Please accept the answer and vote if above response helped you.