Getting Data In
Highlighted

where splunk store syslog data?

Explorer

I install splunk and add syslog port as the input data. i wonder where splunk store the syslog that it received? Do splunk differentiate between the syslog message and the indexed data?

Tags (1)
Highlighted

Re: where splunk store syslog data?

SplunkTrust
SplunkTrust

No, it does not differentiate. All data processed by Splunk - be it syslog data, files being read, or other network sockets - is stored in various Splunk indexes. The syslog message IS the indexed data.

View solution in original post

Highlighted

Re: where splunk store syslog data?

Explorer

thanks for the confirmation. and where is this data stored? Is this meaning that i can't use the syslog messages that Splunk received with other syslog software?

0 Karma
Highlighted

Re: where splunk store syslog data?

Contributor

You could instead of directly ingesting syslog messages into Splunk to first store in a file remote syslog events, using for example rsyslog (http://www.rsyslog.com/storing-messages-from-a-remote-system-into-a-specific-file/), and to point Splunk to that file.

Highlighted

Re: where splunk store syslog data?

SplunkTrust
SplunkTrust

Any data Splunk indexes is stored in an index data structure called a bucket. The internal format of Splunk's buckets is proprietary to the product - so you can't (easily) go poking about inside of a bucket trying to read and understand it.

If you wish to have other software work with your log data, there are some options. Imrago's suggestion of using rsyslog first (and letting splunk read the files it makes) is a good one. Also, you can configure splunk to forward events over a TCP socket to thirs party software.

0 Karma
Highlighted

Re: where splunk store syslog data?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: where splunk store syslog data?

Explorer

thanks imrago...very helpful tool....
thanks dwaddle for the clarification....

0 Karma