Script Hat

If you ever want to search a compressed file using perl this is one way you can incorporate zcat as a filehandle. There are a couple of modules out there for example PerlIO::gzip which seems to work pretty well except I was testing it against bluecoat logs and it seems to have problems with the headers. Also none of the options seemed to decompress past that either. So, I tried using this method and it works great…

#!/usr/local/bin/perl

my $file = "whatever.gz";

my $querystring = "what I'm looking for";

open(ZCAT,"-|") || exec "/bin/zcat",$file;

   while (<ZCAT>)  { 

                if ($_ =~ $searchstring)  {  

                           $i++;

                           $querystring = $_;

                           print $querystring;

                           }

                   }

This is a very fast way to search your compressed files.