I'm using the free version, Is there is a way to backup the syslog from the splunk ? Once the size limit exceed 500 MB for the future reference.Is there option to view the syslog received by splunk in different software line notepad,editor++ etc.
Note that the 500MB is an indexed per day limit. Splunk imposes no limit on the total amount of data stored, the limit there would be the size of the disk. There is no need to archive off the data to keep the total value under 500MB.
You could set a frozenPath, which would allow data to be frozen once it is over a certain size. If you wanted to review the data at some later point, you'd need to thaw it. However, if you wanted to read it via a text editor, the only thing I can think of that would allow for that would be to use outputs.conf to send to a copy of your data to a third party syslog where you could review those logs.
