Installation

How to start indexing a new syslog host?

dritjon
Path Finder

Bear with me as this is the first time im doing this.

I configured a vmware host to send its events via syslog to splunk. It is working. Raw logs are stored in /opt/syslog/192.168.x.x in four different types (local, daemon logs etc)

Now, how do I index these logs? How do I create a new index=vmware which will start index raw logs and I can start searching?

Googled a bit but I cant find a step-by-step tutorial

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dritjon,

let me understand: you configured a syslog-ng or anotehr kind of syslog server that writes the received logs in files of the above folder, is it correct?

The second question is: syslog server in on the same server where Splunk is installed or in a different one?

If in the same server you have to:

  • by GUI create a new index (better) or use an existing one (e.g. main) [Settings -- Indexes -- new Index],
  • by GUI create a new input [Settings -- Data inputs -- Files & Directories -- New Local File & Directory]
  • use your logs in searches

if in different servers, you have to:

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...