Monitoring Splunk

Indexing zip files

sameer12sa
Engager

Hi

I am a new user, who downloaded splunk yesterday and learning to configure for monitoring and searching our production logs.
I have a few questions.
Is there any documentation link where I can find how to configure a splunk host to monitor log files from different hosts on the same network which are linux boxes.
I also need some documentation to configure splunk to search log files.
I have a question regarding indexing zip files. Actually the cron job will zip all the previous log files and keep the log files in the same directory.

Can we have the zip files and current log files in the same directory? Or the rotated zip files should be in different directory.

Thanks
Sameer

Tags (1)
0 Karma

sameer12sa
Engager

Thanks for the quick response.
I am able to successfully configure Splunk Search.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Start with the Getting Data In Manual. It explains how to get data from files and directories, configure event types and source types, and introduces the subject of getting data in a distributed environment.

0 Karma

bbingham
Builder

Sameer, here's the answers to your questions:

  1. About Forwarders
  2. I'm confused on how you mean to search log files, just how to search in splunk in general? Check out the "Getting Started" app inside splunk after you've installed it.
  3. There are a number of ways to deal with this, you can create blacklists to exclude the zips, or you can place them in their own directory. This really becomes your personal choice. Check this link out: Whitelist/Blacklist Incoming Data
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...