topic Reading downloaded log files locally in Getting Data In

Reading downloaded log files locally

deveritt — Mon, 25 Apr 2011 12:41:51 GMT

I simply want to analyse a single log file I've downloaded from our server, and produce some charts, but am running out of time and patience trying to find out how to do this simple task. Any help appreciated.

Re: Reading downloaded log files locally

Brian_Osburn — Mon, 25 Apr 2011 12:58:47 GMT

Go into your local instance of Splunk.
Go to "Manager"
Click "Data Inputs"
Click "Files & Directories"
Click "New"
Select "Upload and Index a file"
Select browse and upload the file.

Re: Reading downloaded log files locally

zpavic — Mon, 25 Apr 2011 13:02:44 GMT

You can use this tutorial Add data to Splunk

Re: Reading downloaded log files locally

deveritt — Mon, 25 Apr 2011 13:21:56 GMT

Since this is the first time I've used it, perhaps I should have added 'does my local instance of Splunk run as an (OS X in my case) app or does it need a locally-running version of Apache?' BTW I'm currently awaiting (30 minutes and counting) an attempt to read said log file locally with Analog...

Re: Reading downloaded log files locally

Brian_Osburn — Mon, 25 Apr 2011 13:22:59 GMT

Nope, it's a stand alone app. You can hit it directly via localhost:8000 and log in that way.

Brian

Re: Reading downloaded log files locally

deveritt — Mon, 25 Apr 2011 13:33:59 GMT

Okay - figured out that it starts up as a server process and not an app. I'm running Splunk 3.4.13 on OS X 10.4.11. I went to "Data Inputs:Files & Directories:New Input" and am awaiting result for a 390MB Apache log file from one of our servers...

Re: Reading downloaded log files locally

Brian_Osburn — Mon, 25 Apr 2011 13:38:41 GMT

Ooof, that's a couple of revisions behind - Splunk 4.2.1 is the latest and greatest..

Re: Reading downloaded log files locally

deveritt — Tue, 26 Apr 2011 06:54:49 GMT

Hmm... it was the latest version actually recommended for OS X 10.4.11 - perhaps more recent versions might work on 10.4?

I've added the log file as a 'New Input', and am looking for the language ref... access.log" | fields referer_domain is the default, but I'm after things like 'page visits' etc.