Getting Data In

Reading downloaded log files locally

deveritt
Explorer

I simply want to analyse a single log file I've downloaded from our server, and produce some charts, but am running out of time and patience trying to find out how to do this simple task. Any help appreciated.

Tags (2)

zpavic
Path Finder

You can use this tutorial Add data to Splunk

Brian_Osburn
Builder
  1. Go into your local instance of Splunk.
  2. Go to "Manager"
  3. Click "Data Inputs"
  4. Click "Files & Directories"
  5. Click "New"
  6. Select "Upload and Index a file"
  7. Select browse and upload the file.

deveritt
Explorer

Hmm... it was the latest version actually recommended for OS X 10.4.11 - perhaps more recent versions might work on 10.4?

I've added the log file as a 'New Input', and am looking for the language ref... access.log" | fields referer_domain is the default, but I'm after things like 'page visits' etc.

0 Karma

Brian_Osburn
Builder

Ooof, that's a couple of revisions behind - Splunk 4.2.1 is the latest and greatest..

0 Karma

deveritt
Explorer

Okay - figured out that it starts up as a server process and not an app. I'm running Splunk 3.4.13 on OS X 10.4.11. I went to "Data Inputs:Files & Directories:New Input" and am awaiting result for a 390MB Apache log file from one of our servers...

0 Karma

Brian_Osburn
Builder

Nope, it's a stand alone app. You can hit it directly via localhost:8000 and log in that way.

Brian

0 Karma

deveritt
Explorer

Since this is the first time I've used it, perhaps I should have added 'does my local instance of Splunk run as an (OS X in my case) app or does it need a locally-running version of Apache?' BTW I'm currently awaiting (30 minutes and counting) an attempt to read said log file locally with Analog...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...