Getting Data In

Logs forwarded from universal forwarder

James8
Explorer

Hi, i would to like to ask: 

1. Where do I find the log files that are being forwarded from an universal forwarder on the machine installed with Splunk Enterprise ? 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

all the logs from UFs are in the Indexes. they are indexed and stored in in buckets with all the indexes that Splunk uses to search them; you haven't forwarded log files, only indexed logs in Indexes.

To understand how splunk indexes logs, you can see at https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes

Ciao.

Giuseppe

0 Karma

James8
Explorer

Ok thanks! Am i able to generate raw log files from these indexed logs?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @James8,

you already have _raw logs!

you have to run a search on the index where you stored logs (e.g. index=my_index) and see logs.

probably you should see the Splunk Documentation about how Splunk works:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

Ciao.

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...