Getting Data In

Where does splunk store the logs?

mihika
Engager

we are in the process of investigating splunk for our IT datacenter.

Does splunk store the old events that occured on a particular system.

Tags (2)

yannK
Splunk Employee
Splunk Employee

Yes, Splunk will store the events that were monitored and send to him by forwarders, or syslog or scripts, or directly monitored etc...

The events are stored in in the splunk indexers in indexes in a timestamp order.
By default the retention size per index is 500GB and the time retention is 6 years. It can be changed of course depending of your needs and of your storage.

slierninja
Communicator

If you are looking for logs for application errors (splunkd.log, python.log, etc.), you can find them here...

$SPLUNK_HOME/var/log/splunk/

gkanapathy
Splunk Employee
Splunk Employee

Please be more specific with your question and provide some context about what you are asking.

0 Karma

Lowell
Super Champion

I'm not sure what you mean by "old logs"? I'm guessing your question has to do with how splunk stores events in general. There is also the discussion about event-retention policies which has to do with how long your events (or logs) are kept around after they have been indexed by splunk, but since your evaluating splunk, I'm guessing you aren't running to that just yet.

Splunk stores all log as indexed events in a proprietary database-like "index" under your splunk install location.

If your a looking for sizing information, it may be helpful to visit the directory where your data is stored. Out of the box, splunk contains several indexes (sometimes called "databases"). Here is the location of your "main" (default) index:

$SPLUNK_HOME/var/lib/splunk/defaultdb

The docs should give you a better idea of how this works. I would start here: What's a Splunk index? and follow the various links provided.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...