Monitoring Splunk

monitoring log file in splunk

Umesh_Vedicsoft
Path Finder

am monitoring the one log file in splunk by declaring the bleow stanza in inputs.conf file.but the problem is whenever i added an event to that log file then its updating( means that event available in splunk search),but if i deleted any event in that log file even though still that event is avaliable in splunk search searched data.what is the reason plz help me.

[monitor://D:\3D Count\access]
disabled = false
index = log_review
sourcetype = access_combined

Tags (1)
0 Karma

Jeremiah
Motivator

When Splunk indexes your log file, it makes a copy of the log data and stores it locally on your splunk server in its index. When you run a search in Splunk, it is not accessing the original log file at all; it is searching its own local copy. Modifying your log file after data has been indexed will not affect what is visible in Splunk. If you want to remove data from Splunk, you'll need to use either the delete or clean index commands. Be extremely careful if you are working on a production server.

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/RemovedatafromSplunk

0 Karma

Umesh_Vedicsoft
Path Finder

hello Jeremiah
thanks for your reply, as per your words I came to know that data is monitoring from local file not from original one but if i inserted new record in original file it is reflecting in splunk, at the same time if I delete the record why it not reflecting in splunk.

0 Karma

Jeremiah
Motivator

The file is not "synchronized" with Splunk in the way you are describing. Once Splunk has seen a log entry in the file, it retains it, regardless if you delete a log entry or the entire original log file. This is by design, logs by definition should be append only, and are usually rotated off of a server after some period of time.

0 Karma

Umesh_Vedicsoft
Path Finder

i am using 6.4.0 version

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...