About rupesh212121

rupesh212121 · ‎03-21-2011

hi my question is how i can store my logs/data on different indexes. please explain the whole process in detail?????

rupesh212121 · ‎03-18-2011

where the rotated logs get saved in splunk.

rupesh212121 · ‎03-18-2011

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

rupesh212121 · ‎03-18-2011

Thanks david for the link. but i wanted to know if someday later if i want to view the log rotated file thn how can i view it. is there any mechanism that this log rotated data can be stored anywhere in splunk for future view or splunk maitains some history anywhere.

rupesh212121 · ‎03-17-2011

my question exactly means that suppose my logs are rotated constantly. for example access.log becomes access.log1 after log rotation. so i mean can i save this access.log1 somewhere in splunk. so whenever i need i can refer this. how i can save my data in different indexes in splunk. and how can i refer whn i need them. what are hot path and cold path in indexes and how can i use them please explain with an example?

rupesh212121 · ‎03-17-2011

When splunk is watching a directory for log files will it reindex a file that gets rotated? I am trying to make sure that some of my logs are not getting indexed twice. Example: file1.log gets changed to file1.log12212010 service creates new file1.log and continues logging where can i save the rotated log file or does splunk have any facility to save the rotated logs. please answer. thank u rupesh.

rupesh212121 · ‎03-17-2011

but it is not accepting the path as it is saying the path already exist.

rupesh212121 · ‎03-17-2011

hi i am getting an error in splunk as soon as i login the error is "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block". please help how i should resolve this error. or what to do?

rupesh212121 · ‎03-10-2011

hi my scenario is i am having different servers in which same services are running like httpd, maillog, errorlog and i want to see logs of all these servers. i have tried to give path for both the servers for seeing it access logs as /var/logs/httpd/access_logs and it gave me the following error. "Encountered the following error while trying to save: In handler 'monitor': Cannot create another input with the name "/var/log/httpd/access_log", one already exists." how can i see the same logs of two different servers. plz help me in this regard. thank u Prakash

Posts	9
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎03-10-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

how to store logs in different indexes

where the rotated logs get save in splunk

saving log rotated files in splunk

where to save rotated logs?

log file rotation

getting error in splunk 4.2 reagarding indexers

error while giving path for different servers