topic Re: Logs forwarded from universal forwarder in Getting Data In

Logs forwarded from universal forwarder

James8 — Fri, 15 Jan 2021 11:07:48 GMT

Hi, i would to like to ask:

1. Where do I find the log files that are being forwarded from an universal forwarder on the machine installed with Splunk Enterprise ?

Re: Logs forwarded from universal forwarder

gcusello — Fri, 15 Jan 2021 11:31:17 GMT

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

Re: Logs forwarded from universal forwarder

James8 — Wed, 20 Jan 2021 00:01:02 GMT

Ok thanks! Am i able to generate raw log files from these indexed logs?

Re: Logs forwarded from universal forwarder

gcusello — Wed, 20 Jan 2021 12:40:31 GMT

Hi @James8,

you already have _raw logs!

you have to run a search on the index where you stored logs (e.g. index=my_index) and see logs.

probably you should see the Splunk Documentation about how Splunk works:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉