Is it possible or advised to add a custom log to the _internal index?

[nnesje]

Is it possible, or advised, to add a custom log to the Splunk _internal index?  What are the formatting rules if a log is added to the default location?

[richgalloway]

Log files have no formatting rules.  You just need to define a sourcetype that can parse them.

[isoutamo]

Hi

you could add those if needed, but you should think what logs are system logs and what are applications logs. Only 1st one should add to internal. A good examples are e.g. some complex TA logs like DB Connect, M365 etc. 

Shortly just write your logs into …./splunk/var/log/splunk directory and splunk automatically add those to _internal. You could check format from any logs already in that directory.

r. Ismo