Hi, I am back again. I have now installed Splunk, added a UDP port 514 network input (by following "Get data from TCP and UDP ports"). Direct the syslog from our Firewall to the 'Splunk server'. Set the machine to boot-start (see above post from MHibbin - thanks it works!). All seems fine and straight forward. Now this is where I get stuck. Where is the captured log on the Splunk server because I did not have to specify where it should go? And how do I look at this log? On the Web interface, I think I need to go to Manager >> Data inputs but I don't know what else to do here. Please can someone point me in the right direction (it's installed on a 10.6 Server)? Thanks. ... View more

Been away for a few days but now back. Thanks mloven and MHibbin for the replies. Will have a go now and hope it will be easy to set up. ... View more

Hi, me again. I still haven't installed Splunk yet until I have read everything up about it first. I have read quite a lot of pages on the Splunk website, especially the "Use Splunk Web" section, the "Install on Mac", and the "Get Data from TCP and UDP" pages and understood what needs to be done before and after installation. However, I cannot find any information if Splunk runs in the background like a service, or do I have to login to the user that Splunk is setup under? I.e. will Splunk continue to receive log from the firewall if the computer is restarted and left in the login screen? Thanks. ... View more

Thanks for that mloven. Will have a look at the link you sent me. Regards. ... View more