Archive

where to save rotated logs?

Explorer

my question exactly means that suppose my logs are rotated constantly. for example access.log becomes access.log1 after log rotation. so i mean can i save this access.log1 somewhere in splunk. so whenever i need i can refer this.

how i can save my data in different indexes in splunk. and how can i refer whn i need them.

what are hot path and cold path in indexes and how can i use them please explain with an example?

Tags (1)
0 Karma

Explorer

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

0 Karma

Splunk Employee
Splunk Employee

Splunk stores the log contents. The log files are not needed by splunk at search time.

0 Karma

Splunk Employee
Splunk Employee

I would set up splunk to monitor access.log. In splunk you will always search on source="/path/to/access.log" -- access.log1 effectively doesn't exist in splunk, but you will always have the search history going back through time, of access.log (before it was rotated), if that makes any sense.

I'd take a look at the following:

Let me know if that answers your question.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!