Find and index data
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Find and index data
There are several methods to get your data into Splunk. Add data via Splunk Web, Splunk's CLI, a configuration file, with scripts, or 3rd party software.
Here's a brief intro on getting data into Splunk. For more detailed instructions, follow any of the links above.
Add Data
When you first log into Splunk Web, you're given three options to begin indexing data:
Option 1: Upload a file
Option 2: Start tailing /var/log
Option 3: Start watching /etc
There are many other ways to specify data inputs in Splunk. This section is a high-level description of these techniques. For more detailed methods, see the data inputs section.
Tail a file
When you specify a file to tail, Splunk processes the entire file and then watches the file and processes additions to it. When you give a directory name to process, Splunk recursively searches all subdirectories looking for files resembling log files. You can explicitly include or exclude files with whitelisting and blacklisting.
Tailing files via Splunk Web
- Click the Admin link in the upper right-hand corner.
- Click the Data Inputs tab.
- The first row is the Files and Directories option. Click the Add input link under the Action heading.
- Under the Source heading:
- select Tail from the Data Access drop-down.
- type in the path to the file in the text box.
Tailing files via the CLI
Use the splunk add command. These commands assume you have set a Splunk environment variable. If you have not, you must navigate to $SPLUNK_HOME/bin and run the ./splunk command.
For example:
splunk add tail /var/log/
This command tails all files in /var/log/.
Find logfiles
Splunk has a built-in CLI command to search for potential log files to index:
splunk find "searchpath1;searchpath2;..."
find searches logs within the specified searchpaths. You can narrow the search by defining restrictions in $SPLUNK_HOME/etc/findlogs.ini. Restrictions can include types of directories and file to ignore, maximum file size, and modification date. After logs are found, you can index some, all, or none of the files. If you answer "Some", Splunk will prompt you file-by-file.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 View the Article History for its revisions.