Hello, I want to index files from a zip archive. In the log file (splunkd.log) I see:
WARN FileClassifierManager - The file '/root/test/test26.zip:./test26.txt' is invalid. Reason: binary
But in the /opt/splunk/etc/system/local/props.conf for my sourcetype was inserted the string:
NO_BINARY_CHECK = true
I thought string isn't work and I temporary deleted it. But after that, the file test27 (without archive) didn't index too. And in the splunkd.log I see:
WARN FileClassifierManager - The file '/root/test/test27.txt' is invalid. Reason: binary
I returned the deleted string and test files without archive was indexed correctly again. So, the stanza NO_BINARY_CHECK = true is work for txt files but doesn't for zip archives. What is reason?
Best regards, Artem.