Getting Data In

Logs forwarded from universal forwarder

James8
Explorer

Hi, i would to like to ask: 

1. Where do I find the log files that are being forwarded from an universal forwarder on the machine installed with Splunk Enterprise ? 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

0 Karma

James8
Explorer

Ok thanks! Am i able to generate raw log files from these indexed logs?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

you already have _raw logs!

you have to run a search on the index where you stored logs (e.g. index=my_index) and see logs.

probably you should see the Splunk Documentation about how Splunk works:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...