Monitoring Splunk

where to save rotated logs?

rupesh212121
Explorer

my question exactly means that suppose my logs are rotated constantly. for example access.log becomes access.log1 after log rotation. so i mean can i save this access.log1 somewhere in splunk. so whenever i need i can refer this.

how i can save my data in different indexes in splunk. and how can i refer whn i need them.

what are hot path and cold path in indexes and how can i use them please explain with an example?

Tags (1)
0 Karma

rupesh212121
Explorer

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Splunk stores the log contents. The log files are not needed by splunk at search time.

0 Karma

David
Splunk Employee
Splunk Employee

I would set up splunk to monitor access.log. In splunk you will always search on source="/path/to/access.log" -- access.log1 effectively doesn't exist in splunk, but you will always have the search history going back through time, of access.log (before it was rotated), if that makes any sense.

I'd take a look at the following:

Let me know if that answers your question.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...