splunk syslog configuration

[bwenge]

How to monitor apache access log with splunk

[LCM]

Do following on the UI: Manager » Data inputs » Files & Directories » Add New

• Monitor a file or directory : < your_path_to_the_file > (eg. /var/logs/apache/apache_access.log)
• Host field value : < your_servername >
• Set sourcetype : Manual
• Source type : < apache_access >
• Index : default

Save the whole thing, go back to the search app and type: sourcetype=apache_access

• http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkcanmonitor
• http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories