I have installed Splunk on cent-os 6.5 and able to see the syslog events on GUI. I want to see those events on CLI too.
So what is the path of these events that will be stored so that I can verify in that file.
Got some info that the log file will be under $SPLUNKHOME/var/lib/splunk/[IndexName] , but i didnt see any file here.
[root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/ audit/ .dirty_database historydb/ _introspection.dat summary.dat _thefishbucket.dat _audit.dat fishbucket/ _internal.dat kvstore/ summarydb/ authDb/ hashDb/ _internaldb/ main.dat _telemetry/ defaultdb/ history.dat _introspection/ persistentstorage/ _telemetry.dat [root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/
thanks in advance.
All data ingested to Splunk are saved in the index at the same location you are accessing above (default path for indexes, and it can be changed).
The index is a proprietary data store created by Splunk and it consists of raw files which are not supposed to viewed by a text editor, however if you grep certain log lines you will get the corresponding bucket.
grep -R 'port=49872' /opt/splunk/var/lib/splunk//*
For more details have a look to this question:
tsidx format is not really geared for direct examination but you can, as @aakwah explained. The other thing that you can do is run searches from the CLI, like this:
/opt/splunk/bin/splunk search "index=foo bar"
Also, you can check your syslog configuration to see where it is writing the incoming data (or your Splunk
inputs.conf) and do a
tail -f <filename> on those files to see the data coming in. You can also use
tcpdump to snoop the incoming port to grab it before/as it comes into syslog.