Where can I find the internal logs in the Splunk 5.0.1 file directory?

[skuma30]

Hi,

I'm trying to find the var/log/splunk/ folder logs to check the errors and warning but in the older versions splunk 5.0.1 I'm not able to find any of the logs can anyone please address me at this stage.

Sathish

[richgalloway]

The log files should be in $SPLUNK_HOME/var/log/splunk. SPLUNK_HOME defaults to /opt/splunk, but could be different in your environment. You might also be able to view the logs from the Splunk GUI by searching index=_internal source="*.log".

You should also know, if you don't already, that Splunk will be ending support for version 5.x in November.

[skuma30]

Thanks for the reply @richgalloway, but I cannot able to find any logs for one of my host which is having 5.0.1 version and I do know that support is going to end in November, before that I'm trying to upgrade my old versions. Can you help me how to search the indexed local files of this service, and why it is not reading the /var/log/splunk/ .log files.

[richgalloway]

It's been a long time since I used a 5.x version of Splunk, but I believe the log location has not changed. You should find the logs at /opt/splunk/var/log/splunk, assuming you installed Splunk in the default location.
Searching the indexed logs requires access to the _internal index. You may need to contact your Splunk admin to get access to that index.