how do I pull in Tomcat logs, ie catalina.log' periodically

[jchilovich]

I've read many a post and either I'm just not getting it or it's just not the answer. I want to index the daily catalina log file (per each JVM)say every 5 minutes and of course only want those lines new in the last 5 minute time frame? I'm assuming I need to write a stanze in the inputs.conf but unsure on the format and how to capture the timestamp and save from the last run.

Thanks

[jchilovich]

Thanks for the info. I'll work on setup.

[jchilovich]

Thanks for the info. I'll work on setup.

[alacercogitatus]

I think you are misunderstanding how Splunk works. Install the forwarder on your machine, configure the inputs.conf to look at your catalina.out file, and there you are! Splunk keeps track of where it is in the file, and will even let you rotate the file and start from the beginning. No need to check every 5 minutes, it will run continuously.

[alacercogitatus]

You don't want a heavy forwarder in this case. The Universal Forwarder will send the logs to the main instance, and then you can search for your logs there. Data retention is based on index, so if you don't need your data searchable after 7 days, a separate index would work. I combine them all into a generic "app" index and keep it around longer for trends and historical.

[jchilovich]

I'm somewhat new to Splunk so no, you're correct. So I would create an entry in each forwarder for each log (heavy forwarder so could also use the GUI interface? )then splunk keeps track. ok, makes sense. Do you suggest a seperate index for these type of logs so I can also add entry to 'delete' after say 7 days?