topic Re: Adding a custom log to the _internal index in Splunk Enterprise

Is it possible or advised to add a custom log to the _internal index?

nnesje — Fri, 10 Feb 2023 17:43:29 GMT

Is it possible, or advised, to add a custom log to the Splunk _internal index? What are the formatting rules if a log is added to the default location?

Re: Adding a custom log to the _internal index

isoutamo — Fri, 10 Feb 2023 06:45:35 GMT

you could add those if needed, but you should think what logs are system logs and what are applications logs. Only 1st one should add to internal. A good examples are e.g. some complex TA logs like DB Connect, M365 etc.

Shortly just write your logs into …./splunk/var/log/splunk directory and splunk automatically add those to _internal. You could check format from any logs already in that directory.

r. Ismo

Re: Adding a custom log to the _internal index

richgalloway — Fri, 10 Feb 2023 13:09:37 GMT

Log files have no formatting rules. You just need to define a sourcetype that can parse them.