Hi,
I have a TGZ file that needs to be indexed into Splunk. Configuring inputs.conf is easy enough. The part I'm having trouble with is this TGZ file contains several files but I'm only interested in one. Is there a way to have the Universal Forwarder open up the TGZ but only index one file?
↧