Dashboards & Visualizations

how to view the exact content of a logfile

Isaias_Garcia
Path Finder

Hi-

I modified the input.conf file to monitor all logs in /var/log. ( I restarted splunk after editing inputs.conf)

[monitor:///var/log]
disabled = false
followTail = 0
host = xxxxyyyzzz
index = dev

I made a script that will create a logfile(lptvpn.log) into /var/log directory .
The exact content of the logfile should be this
root@xxxxyyyzzz:/var/log# cat lptvpn.log
LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659

But when I searched it in the Splunk using this search query "lptvpn.log" I am getting this logs:

INFO LicenseUsage - type=Usage s="/var/log/lptvpn.log" st="lptvpn-too_small" h=xxxxyyyzzz o="" i="7091808B-9D8A-431D-80EC-D5BEF63F14F3" pool="auto_generated_pool_enterprise" b=72 poolsz=2147483648

Question: How will I search or view the exact log of lptvpn.log? (i.e. "LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659") Do I need to modify the input.conf?Thanks in advance

Tags (3)
0 Karma

lguinn2
Legend

The results of your query came from the _internal index. You might want to change the settings for your role so that it doesn't automatically search the internal indexes. Also, you might want to check to see if the any data from /var/log actually appears in the dev index. I would probably do this search:

index=dev source=*lptvpn.log
0 Karma

lguinn2
Legend

http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role

is the documentation on how to edit a role.

Do you create an index named dev? Here is the documentation for creating an index - you have to do that before you can send data to it...

http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setupmultipleindexes#Create_and_edit_index...

0 Karma

Isaias_Garcia
Path Finder

Thanks Iguinn. How can I change the settings for my role?I tried "index=dev source=*lptvpn.log" but it returned 0 matching events.Please advise. 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...