Real time file on linux that we can monitor for Splunk

[Deepali529]

Can anyone tell me in which file we can monitor real time data for Splunk on Linux?

[gcusello]

Hi Deepali529,
Could you describe better your request?
Real Data you said are Linux logs or Splunk logs?
Every way, if you want to monitor real data Splunk logs you have to search index=_internal and put the time period to Real data choosing a Time window you like.
After you can refine your search choosing a sourcetype.

Splunk logs are written in some files $SPLUNK_HOME/var/log/splunk (splunkd.log, ...) and indexed by Splunk in the _internal index.

Bye.
Giuseppe