how to view the exact content of a logfile

[Isaias_Garcia]

Hi-

I modified the input.conf file to monitor all logs in /var/log. ( I restarted splunk after editing inputs.conf)

[monitor:///var/log]
disabled = false
followTail = 0
host = xxxxyyyzzz
index = dev

I made a script that will create a logfile(lptvpn.log) into /var/log directory .
The exact content of the logfile should be this
root@xxxxyyyzzz:/var/log# cat lptvpn.log
LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659

But when I searched it in the Splunk using this search query "lptvpn.log" I am getting this logs:

INFO LicenseUsage - type=Usage s="/var/log/lptvpn.log" st="lptvpn-too_small" h=xxxxyyyzzz o="" i="7091808B-9D8A-431D-80EC-D5BEF63F14F3" pool="auto_generated_pool_enterprise" b=72 poolsz=2147483648

Question: How will I search or view the exact log of lptvpn.log? (i.e. "LATEST UPDATE : Mar 12 18:14 LATEST ANTI-VIRUS DEFINITION : lpt$vpn.659") Do I need to modify the input.conf?Thanks in advance

[lguinn2]

The results of your query came from the _internal index. You might want to change the settings for your role so that it doesn't automatically search the internal indexes. Also, you might want to check to see if the any data from /var/log actually appears in the dev index. I would probably do this search:

index=dev source=*lptvpn.log

[lguinn2]

http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles#Add_or_edit_a_role

is the documentation on how to edit a role.

Do you create an index named dev? Here is the documentation for creating an index - you have to do that before you can send data to it...

http://docs.splunk.com/Documentation/Splunk/6.0.2/Indexer/Setupmultipleindexes#Create_and_edit_index...

[Isaias_Garcia]

Thanks Iguinn. How can I change the settings for my role?I tried "index=dev source=*lptvpn.log" but it returned 0 matching events.Please advise. 🙂