where to save rotated logs?

[rupesh212121]

my question exactly means that suppose my logs are rotated constantly. for example access.log becomes access.log1 after log rotation. so i mean can i save this access.log1 somewhere in splunk. so whenever i need i can refer this.

how i can save my data in different indexes in splunk. and how can i refer whn i need them.

what are hot path and cold path in indexes and how can i use them please explain with an example?

[rupesh212121]

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

[jrodman]

Splunk stores the log contents. The log files are not needed by splunk at search time.

[David]

I would set up splunk to monitor access.log. In splunk you will always search on source="/path/to/access.log" -- access.log1 effectively doesn't exist in splunk, but you will always have the search history going back through time, of access.log (before it was rotated), if that makes any sense.

I'd take a look at the following:

• http://www.splunk.com/base/Documentation/4.1.7/Admin/Howlogfilerotationishandled
• http://www.splunk.com/base/Documentation/latest/Data/Monitorfilesanddirectories

Let me know if that answers your question.