This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
There are several methods to get your data into Splunk. Add data via Splunk Web, Splunk's CLI, a configuration file, with scripts, or 3rd party software.
Here's a brief intro on getting data into Splunk. For more detailed instructions, follow any of the links above.
When you first log into Splunk Web, you're given three options to begin indexing data:
Option 1: Upload a file
Option 2: Start tailing /var/log
Option 3: Start watching /etc
There are many other ways to specify data inputs in Splunk. This section is a high-level description of these techniques. For more detailed methods, see the data inputs section.
When you specify a file to tail, Splunk processes the entire file and then watches the file and processes additions to it. When you give a directory name to process, Splunk recursively searches all subdirectories looking for files resembling log files. You can explicitly include or exclude files with whitelisting and blacklisting.
Use the splunk add command. These commands assume you have set a Splunk environment variable. If you have not, you must navigate to $SPLUNK_HOME/bin and run the ./splunk command.
For example:
splunk add tail /var/log/
This command tails all files in /var/log/.
Splunk has a built-in CLI command to search for potential log files to index:
splunk find "searchpath1;searchpath2;..."
find searches logs within the specified searchpaths. You can narrow the search by defining restrictions in $SPLUNK_HOME/etc/findlogs.ini. Restrictions can include types of directories and file to ignore, maximum file size, and modification date. After logs are found, you can index some, all, or none of the files. If you answer "Some", Splunk will prompt you file-by-file.