Hi-
I modified the input.conf file to monitor all logs in /var/log. ( I restarted splunk after editing inputs.conf)
[monitor:///var/log]
disabled = false
followTail = 0
host = xxxxyyyzzz
index = dev
I made a script that will create a logfile(lptvpn.log) into /var/log directory .
The exact content of the logfile should be this
root@xxxxyyyzzz:/var/log# cat lptvpn.log
LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659
But when I searched it in the Splunk using this search query "lptvpn.log" I am getting this logs:
INFO LicenseUsage - type=Usage s="/var/log/lptvpn.log" st="lptvpn-too_small" h=xxxxyyyzzz o="" i="7091808B-9D8A-431D-80EC-D5BEF63F14F3" pool="auto_generated_pool_enterprise" b=72 poolsz=2147483648
Question: How will I search or view the exact log of lptvpn.log? (i.e. "LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659") Do I need to modify the input.conf?Thanks in advance
The results of your query came from the _internal
index. You might want to change the settings for your role so that it doesn't automatically search the internal indexes. Also, you might want to check to see if the any data from /var/log
actually appears in the dev
index. I would probably do this search:
index=dev source=*lptvpn.log
http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role
is the documentation on how to edit a role.
Do you create an index named dev
? Here is the documentation for creating an index - you have to do that before you can send data to it...
Thanks Iguinn. How can I change the settings for my role?I tried "index=dev source=*lptvpn.log" but it returned 0 matching events.Please advise. 🙂