topic Re: How to read syslog events in Linux CLI? in Getting Data In

How to read syslog events in Linux CLI?

thirumal_tr — Tue, 29 Sep 2020 14:09:57 GMT

hai,

I have installed Splunk on cent-os 6.5 and able to see the syslog events on GUI. I want to see those events on CLI too.

So what is the path of these events that will be stored so that I can verify in that file.

Got some info that the log file will be under $SPLUNK_HOME/var/lib/splunk/[Index_Name] , but i didnt see any file here.

[root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/
audit/              .dirty_database     historydb/          _introspection.dat  summary.dat         _thefishbucket.dat
_audit.dat          fishbucket/         _internal.dat       kvstore/            summarydb/
authDb/             hashDb/             _internaldb/        main.dat            _telemetry/
defaultdb/          history.dat         _introspection/     persistentstorage/  _telemetry.dat
[root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/

thanks in advance.

Re: How to read syslog events in Linux CLI?

aakwah — Mon, 22 May 2017 14:06:19 GMT

Hello,

All data ingested to Splunk are saved in the index at the same location you are accessing above (default path for indexes, and it can be changed).

The index is a proprietary data store created by Splunk and it consists of raw files which are not supposed to viewed by a text editor, however if you grep certain log lines you will get the corresponding bucket.

For example:

grep -R 'port=49872' /opt/splunk/var/lib/splunk//*

For more details have a look to this question:

https://answers.splunk.com/answers/6467/what-is-splunk-database-engine.html

Regards

Re: How to read syslog events in Linux CLI?

woodcock — Mon, 22 May 2017 18:47:49 GMT

The splunk tsidx format is not really geared for direct examination but you can, as @aakwah explained. The other thing that you can do is run searches from the CLI, like this:

/opt/splunk/bin/splunk search "index=foo bar"

Also, you can check your syslog configuration to see where it is writing the incoming data (or your Splunk inputs.conf) and do a tail -f <filename> on those files to see the data coming in. You can also use tcpdump to snoop the incoming port to grab it before/as it comes into syslog.