Getting Data In

Indexing 7-Zip Files.

sthao
New Member

I am using Splunk 4.2 and would like to know if .7z files can be indexed?

I have attempted to index .7z files via the below steps, but have been unsuccessful:

  1. Copying the crawl.conf file from ..\etc\system\default.
  2. Placing the crawl.conf file in ..\etc\system\local.
  3. Adding 7z to the packed_extensions_list line.
  4. Restarting Splunk.
  5. Re-indexing the location which holds the .7z files.

Thank you for any direction that can be given!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No. Splunk has configurations for gzip, bz2, and compress files, among others, but not 7z. You could probably add support for that if you choose and install a command-line decompressor with streaming decompression by mimicking the configuration for tgz files.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. Splunk has configurations for gzip, bz2, and compress files, among others, but not 7z. You could probably add support for that if you choose and install a command-line decompressor with streaming decompression by mimicking the configuration for tgz files.

0 Karma

sthao
New Member

Thanks for the prompt response! I may just end up having to stick with ZIP files, instead of 7z files then.

If I were to attempt support of 7z files, where would I go to get more info on mimicking the tgz configuration/setup?

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...