How to read syslog events in Linux CLI?

[thirumal_tr]

hai,

I have installed Splunk on cent-os 6.5 and able to see the syslog events on GUI. I want to see those events on CLI too.

So what is the path of these events that will be stored so that I can verify in that file.

Got some info that the log file will be under $SPLUNK_HOME/var/lib/splunk/[Index_Name] , but i didnt see any file here.

[root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/
audit/              .dirty_database     historydb/          _introspection.dat  summary.dat         _thefishbucket.dat
_audit.dat          fishbucket/         _internal.dat       kvstore/            summarydb/
authDb/             hashDb/             _internaldb/        main.dat            _telemetry/
defaultdb/          history.dat         _introspection/     persistentstorage/  _telemetry.dat
[root@Thirumal-LDNS ~]# vim /opt/splunk/var/lib/splunk/

thanks in advance.

[woodcock]

The splunk tsidx format is not really geared for direct examination but you can, as @aakwah explained. The other thing that you can do is run searches from the CLI, like this:

/opt/splunk/bin/splunk search "index=foo bar"

Also, you can check your syslog configuration to see where it is writing the incoming data (or your Splunk inputs.conf) and do a tail -f <filename> on those files to see the data coming in. You can also use tcpdump to snoop the incoming port to grab it before/as it comes into syslog.

[aakwah · Accepted solution]

Hello,

All data ingested to Splunk are saved in the index at the same location you are accessing above (default path for indexes, and it can be changed).

The index is a proprietary data store created by Splunk and it consists of raw files which are not supposed to viewed by a text editor, however if you grep certain log lines you will get the corresponding bucket.

For example:

grep -R 'port=49872' /opt/splunk/var/lib/splunk//*

For more details have a look to this question:

https://answers.splunk.com/answers/6467/what-is-splunk-database-engine.html

Regards