Getting Data In

Reading downloaded log files locally

deveritt
Explorer

I simply want to analyse a single log file I've downloaded from our server, and produce some charts, but am running out of time and patience trying to find out how to do this simple task. Any help appreciated.

Tags (2)

zpavic
Path Finder

You can use this tutorial Add data to Splunk

Brian_Osburn
Builder
  1. Go into your local instance of Splunk.
  2. Go to "Manager"
  3. Click "Data Inputs"
  4. Click "Files & Directories"
  5. Click "New"
  6. Select "Upload and Index a file"
  7. Select browse and upload the file.

deveritt
Explorer

Hmm... it was the latest version actually recommended for OS X 10.4.11 - perhaps more recent versions might work on 10.4?

I've added the log file as a 'New Input', and am looking for the language ref... access.log" | fields referer_domain is the default, but I'm after things like 'page visits' etc.

0 Karma

Brian_Osburn
Builder

Ooof, that's a couple of revisions behind - Splunk 4.2.1 is the latest and greatest..

0 Karma

deveritt
Explorer

Okay - figured out that it starts up as a server process and not an app. I'm running Splunk 3.4.13 on OS X 10.4.11. I went to "Data Inputs:Files & Directories:New Input" and am awaiting result for a 390MB Apache log file from one of our servers...

0 Karma

Brian_Osburn
Builder

Nope, it's a stand alone app. You can hit it directly via localhost:8000 and log in that way.

Brian

0 Karma

deveritt
Explorer

Since this is the first time I've used it, perhaps I should have added 'does my local instance of Splunk run as an (OS X in my case) app or does it need a locally-running version of Apache?' BTW I'm currently awaiting (30 minutes and counting) an attempt to read said log file locally with Analog...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...