Getting Data In

Zip files not getting indexed

lohit
Path Finder

Hi ,

I am trying to index Vulnerbility Scanner reports in Splunk. I have configured my Vulnerbility Scanner to store the reports in a location D:\reports. So it creates files in directories like D:\reports\abc.zip\1\en\vulnerability.csv. Everytime scanner will run it willl log a report in D:\reports\ .So that means in abc.zip\1\en\vulnerability.csv only the zip file name will change.So i have configured the following in inputs.conf

[monitor://D:\reports\...\vulnerability.csv]
initCrcLength = 1024(changed it because reports have common headers)
crcSalt = <SOURCE>
disabled = false

But i am not able to see the files being indexed.

pls help !!

Tags (2)
0 Karma

Ayn
Legend

Splunk doesn't treat zip files as directories (because they aren't), so doing ... in your monitor statement won't make Splunk open your zip files and recurse into them. Easiest would be to just index the whole zip.

lohit
Path Finder

Just to add to that , there will be multiple ZIp files in the same folder 'report'.

lohit
Path Finder

ok ayn.. but i have to pick only a particular file in zip folder to be indexed. how to do that

0 Karma

lohit
Path Finder

Not sure where the path seperator() went in my question.

😧 reports abc.zip 1 vulnerability.csv..

PLs consider each space with a ()

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...