We have a compressed (via python zlib) JSON file that is "chunked" prior to being indexed by Splunk.
The multiple events in Splunk (once indexed) can be pieced together (via Splunk's transaction command) yielding one event, containing multiple fields, one of which contains the compressed JSON file.
How do we decompress this one field in Splunk given the data has already been indexed?
(Decompressing earlier in the process, like during indexing, doesn't seem reasonable because data arrives in pieces due to various size limitations.)
Thanks.
↧