If you didn't specify an index then they will end up in index=main. Look for tcp, that IP, and that port in the source field. ... View more

Hi Mahmudomer, You can monitor any local / Remote directory from command line by running command with required parameter. Local, ./splunk add monitor <log path> In-Case the files are in remote then you can use TCP/UDP. Read Splunk documentation Link Mount filesystem / soft link may help you . ... View more

The best advice if you are new with Splunk is begin with the Web Framework, please read the documentation and the wiki for detailed instructions. About the alerts: http://www.splunk.com/view/SP-CAAAGYG http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Setupalertactions http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Alertexamples Bye. ... View more