Getting Data In

Logs forwarded from universal forwarder

James8
Explorer

Hi, i would to like to ask: 

1. Where do I find the log files that are being forwarded from an universal forwarder on the machine installed with Splunk Enterprise ? 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

0 Karma

James8
Explorer

Ok thanks! Am i able to generate raw log files from these indexed logs?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

you already have _raw logs!

you have to run a search on the index where you stored logs (e.g. index=my_index) and see logs.

probably you should see the Splunk Documentation about how Splunk works:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...