The logs are saved in Splunk's index, or "database" if you will. File system-wise, an index is distributed across a number of files, by default in $SPLUNK_HOME/var/lib . These files are in a proprietary format that cannot (easily) be used for reading directly. More information on Splunk indexes: http://docs.splunk.com/Documentation/Splunk/latest/admin/WhatsaSplunkindex If you already set up so that Splunk is getting the logs from the Fortigate firewall, you likely should know either source, sourcetype or host. If not, that's the place to start. Give us more details about that part of the Splunk setup, and we'll see if we can help you. ... View more