https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185338#M11444 <P>Thanks Iguinn. How can I change the settings for my role?I tried "index=dev source=*lptvpn.log" but it returned 0 matching events.Please advise. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 13 Mar 2014 04:36:08 GMT Isaias_Garcia 2014-03-13T04:36:08Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185336#M11442 <P>Hi-</P> <P>I modified the input.conf file to monitor all logs in /var/log. ( I restarted splunk after editing inputs.conf)</P> <P>[monitor:///var/log]<BR /> disabled = false<BR /> followTail = 0<BR /> host = xxxxyyyzzz<BR /> index = dev</P> <P>I made a script that will create a logfile(lptvpn.log) into /var/log directory .<BR /> The exact content of the logfile should be this<BR /> root@xxxxyyyzzz:/var/log# cat lptvpn.log<BR /> LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659</P> <P>But when I searched it in the Splunk using this search query "lptvpn.log" I am getting this logs:</P> <P>INFO LicenseUsage - type=Usage s="/var/log/lptvpn.log" st="lptvpn-too_small" h=xxxxyyyzzz o="" i="7091808B-9D8A-431D-80EC-D5BEF63F14F3" pool="auto_generated_pool_enterprise" b=72 poolsz=2147483648</P> <P>Question: How will I search or view the exact log of lptvpn.log? (i.e. "LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659") Do I need to modify the input.conf?Thanks in advance</P> Mon, 28 Sep 2020 16:07:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185336#M11442 Isaias_Garcia 2020-09-28T16:07:07Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185337#M11443 <P>The results of your query came from the <CODE>_internal</CODE> index. You might want to change the settings for your role so that it doesn't automatically search the internal indexes. Also, you might want to check to see if the any data from <CODE>/var/log</CODE> actually appears in the <CODE>dev</CODE> index. I would probably do this search:</P> <PRE><CODE>index=dev source=*lptvpn.log </CODE></PRE> Thu, 13 Mar 2014 04:19:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185337#M11443 lguinn2 2014-03-13T04:19:12Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185338#M11444 <P>Thanks Iguinn. How can I change the settings for my role?I tried "index=dev source=*lptvpn.log" but it returned 0 matching events.Please advise. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 13 Mar 2014 04:36:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185338#M11444 Isaias_Garcia 2014-03-13T04:36:08Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185339#M11445 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role">http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role</A></P> <P>is the documentation on how to edit a role.</P> <P>Do you create an index named <CODE>dev</CODE>? Here is the documentation for creating an index - you have to do that before you can send data to it...</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setupmultipleindexes#Create_and_edit_indexes">http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setupmultipleindexes#Create_and_edit_indexes</A></P> Thu, 13 Mar 2014 06:31:39 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-view-the-exact-content-of-a-logfile/m-p/185339#M11445 lguinn2 2014-03-13T06:31:39Z