where splunk store syslog data?

[channy]

I install splunk and add syslog port as the input data. i wonder where splunk store the syslog that it received? Do splunk differentiate between the syslog message and the indexed data?

[dwaddle · Accepted solution]

No, it does not differentiate. All data processed by Splunk - be it syslog data, files being read, or other network sockets - is stored in various Splunk indexes. The syslog message IS the indexed data.

[channy]

thanks imrago...very helpful tool....
thanks dwaddle for the clarification....

[dwaddle]

http://www.splunk.com/base/Documentation/latest/Deploy/Forwarddatatothird-partysystemsd

[dwaddle]

Any data Splunk indexes is stored in an index data structure called a bucket. The internal format of Splunk's buckets is proprietary to the product - so you can't (easily) go poking about inside of a bucket trying to read and understand it.

If you wish to have other software work with your log data, there are some options. Imrago's suggestion of using rsyslog first (and letting splunk read the files it makes) is a good one. Also, you can configure splunk to forward events over a TCP socket to thirs party software.

[imrago]

You could instead of directly ingesting syslog messages into Splunk to first store in a file remote syslog events, using for example rsyslog (http://www.rsyslog.com/storing-messages-from-a-remote-system-into-a-specific-file/), and to point Splunk to that file.

[channy]

thanks for the confirmation. and where is this data stored? Is this meaning that i can't use the syslog messages that Splunk received with other syslog software?