topic Re: Logs not visible in splunk in Splunk Enterprise

Logs not visible in splunk

VijaySrrie — Thu, 26 Nov 2020 07:28:19 GMT

Hi All,

User has configured to send the logs from his end to splunk via syslog method.

He has enabled debug logs at his end.

We are able to see the logs in Splunk Search Head (Log in /log out/ some other logs)

When user performs show command at his end --> Those logs are not seen in splunk.

May I know what is missing here?

Thanks,

Vijay Sri S

Re: Logs not visible in splunk

blakem — Thu, 26 Nov 2020 08:27:02 GMT

> We are able to see the logs in Splunk Search Head (Log in /log out/ some other logs)

> When user performs show command at his end --> Those logs are not seen in splunk.

From my understanding, your Splunk account when doing a search can see the logs, sent via syslog from some system. Another Splunk account when doing a search can't see the logs.

If that's correct, it's likely the other account isn't set to search the index they're going into by default, or doesn't have permissions to search the index they're going int.

If they have access, adding index=syslog (or whatever index the data is going to) to the start of your search string will search the data.

Default indexes to search are set in the roles area.

Index permissions are set in the index area.

Re: Logs not visible in splunk

VijaySrrie — Thu, 26 Nov 2020 13:48:42 GMT

No.

No one is able to view the logs (person who has access to that particular index/admins), which user is referring to.

User executed the show commands and some other commands in front of us, but we are not able to see those logs in splunk, [User has enabled debug logs at his end, so all the logs should be visible in splunk]