Monitoring Splunk

Can I put a custom log file in $SPLUNK_HOME/var/log/splunk?

joxley
Path Finder

I have a scripted input that writes diagnostic information out to /var/log/myscript.log. I have a monitor on that file sending it to the main index with the sourcetype myscript_log for debugging purposes.

Is is appropriate to put the file in $SPLUNK_HOME/var/log/splunk/myscript.log?

Will this file be automatically sucked into splunk?

If so will it go into _internal?

If not, is it appropriate to put it in _internal?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi joxley,

sure you can do this, by default you have a inputs monitor like this:

[monitor:///opt/splunk/var/log/splunk]
index = _internal

so your log will end up in index=_internal as well. But keep in mind that the default retention for _internal is only 30 days.

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi joxley,

sure you can do this, by default you have a inputs monitor like this:

[monitor:///opt/splunk/var/log/splunk]
index = _internal

so your log will end up in index=_internal as well. But keep in mind that the default retention for _internal is only 30 days.

cheers, MuS

yannK
Splunk Employee
Splunk Employee

remember that :
- splunk will not manage your log, it only rotated the ones defined in the .../etc/log.cfg
- and that this input does not work on universal and lightweight forwarders (that use a special output filter and keys to drop all data except splunkd.log)

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...