topic Where does splunk store the logs? in Getting Data In

Where does splunk store the logs?

mihika — Sat, 19 Jun 2010 00:40:09 GMT

we are in the process of investigating splunk for our IT datacenter.

Does splunk store the old events that occured on a particular system.

Re: Where does splunk store the logs?

Lowell — Sat, 19 Jun 2010 00:52:02 GMT

I'm not sure what you mean by "old logs"? I'm guessing your question has to do with how splunk stores events in general. There is also the discussion about event-retention policies which has to do with how long your events (or logs) are kept around after they have been indexed by splunk, but since your evaluating splunk, I'm guessing you aren't running to that just yet.

Splunk stores all log as indexed events in a proprietary database-like "index" under your splunk install location.

If your a looking for sizing information, it may be helpful to visit the directory where your data is stored. Out of the box, splunk contains several indexes (sometimes called "databases"). Here is the location of your "main" (default) index:

$SPLUNK_HOME/var/lib/splunk/defaultdb

The docs should give you a better idea of how this works. I would start here: What's a Splunk index? and follow the various links provided.

Re: Where does splunk store the logs?

gkanapathy — Sat, 19 Jun 2010 11:28:34 GMT

Please be more specific with your question and provide some context about what you are asking.

Re: Where does splunk store the logs?

slierninja — Sat, 16 Feb 2013 13:56:29 GMT

If you are looking for logs for application errors (splunkd.log, python.log, etc.), you can find them here...

$SPLUNK_HOME/var/log/splunk/

Re: Where does splunk store the logs?

yannK — Sat, 16 Feb 2013 22:36:58 GMT

Yes, Splunk will store the events that were monitored and send to him by forwarders, or syslog or scripts, or directly monitored etc...

The events are stored in in the splunk indexers in indexes in a timestamp order.
By default the retention size per index is 500GB and the time retention is 6 years. It can be changed of course depending of your needs and of your storage.