Archive

Where can I find the internal logs in the Splunk 5.0.1 file directory?

New Member

Hi,

I'm trying to find the var/log/splunk/ folder logs to check the errors and warning but in the older versions splunk 5.0.1 I'm not able to find any of the logs can anyone please address me at this stage.

Sathish

0 Karma

SplunkTrust
SplunkTrust

The log files should be in $SPLUNKHOME/var/log/splunk. SPLUNKHOME defaults to /opt/splunk, but could be different in your environment. You might also be able to view the logs from the Splunk GUI by searching index=_internal source="*.log".

You should also know, if you don't already, that Splunk will be ending support for version 5.x in November.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thanks for the reply @richgalloway, but I cannot able to find any logs for one of my host which is having 5.0.1 version and I do know that support is going to end in November, before that I'm trying to upgrade my old versions. Can you help me how to search the indexed local files of this service, and why it is not reading the /var/log/splunk/ .log files.

0 Karma

SplunkTrust
SplunkTrust

It's been a long time since I used a 5.x version of Splunk, but I believe the log location has not changed. You should find the logs at /opt/splunk/var/log/splunk, assuming you installed Splunk in the default location.
Searching the indexed logs requires access to the _internal index. You may need to contact your Splunk admin to get access to that index.

---
If this reply helps you, an upvote would be appreciated.
0 Karma