Documentation: 3.1.5
|  Print Version Contents
This page last updated: 11/20/07 04:11pm

Add binary files

By default, Splunk ignores binary files. However, you can set props.conf to enable consumption of binary files.

Configuration

You can enable binary file consumption based on source, sourcetype or host in $SPLUNK_HOME/etc/bundles/local/props.conf.

Add the following to props.conf:

[<spec>]
NO_BINARY_CHECK = True
$ATTRIBUTE = $VALUE

<spec> can be:
1. <sourcetype>, the sourcetype of an event
2. host::<host>, where <host> is the host for an event
3. source::<source>, where <source> is the source for an event

$ATTRIBUTE = $VALUE can be any number of additional attribute/value pairs you may wish to set for that <spec>.

Example

[host::robot]
NO_BINARY_CHECK = True
SHOULD_LINEMERGE = false

This example turns off binary checking for all files the come from host::robot. SHOULD_LINEMERGE = false means Splunk will break events every time it sees a newline.

Previous: Scripted inputs    |    Next: log4j

Comments

No comments have been submitted.

Log in to comment.