Can I put a custom log file in $SPLUNK_HOME/var/log/splunk?

[joxley]

I have a scripted input that writes diagnostic information out to /var/log/myscript.log. I have a monitor on that file sending it to the main index with the sourcetype myscript_log for debugging purposes.

Is is appropriate to put the file in $SPLUNK_HOME/var/log/splunk/myscript.log?

Will this file be automatically sucked into splunk?

If so will it go into _internal?

If not, is it appropriate to put it in _internal?

[MuS · Accepted solution]

Hi joxley,

sure you can do this, by default you have a inputs monitor like this:

[monitor:///opt/splunk/var/log/splunk]
index = _internal

so your log will end up in index=_internal as well. But keep in mind that the default retention for _internal is only 30 days.

cheers, MuS

[yannK]

remember that :
- splunk will not manage your log, it only rotated the ones defined in the .../etc/log.cfg
- and that this input does not work on universal and lightweight forwarders (that use a special output filter and keys to drop all data except splunkd.log)