Splunk® Enterprise

Troubleshooting Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

What Splunk Enterprise logs about itself

Splunk Enterprise keeps track of its activity by logging to various files in $SPLUNK_HOME/var/log/splunk.

The Splunk Enterprise internal log files are rolled based on size. You can change the default log rotation size by editing $SPLUNK_HOME/etc/log.cfg.

Search these files in Splunk Web by typing:


Internal logs

This page is currently a work in progress; expect frequent near-term updates.

Here is a list, with descriptions, of the internal logs in $SPLUNK_HOME/var/log/splunk. The Splunk Enterprise internal logs are useful for troubleshooting or metric analysis.

Note that some log files are not created until your Splunk Enterprise instance uses them, for example crawl.log.

Log file name Useful for?
audit.log Stats about user activity. For example, if you're looking for information about a saved search, audit.log matches the name of your saved search (savedsearch_name) with its search ID (search_id), user, and time. With the search_id, you can look up that particular search elsewhere, like in the search dispatch directory. Read about audit events in the Securing Splunk Manual.
btool.log Log of btool activity. Read about btool in this manual.
crawl.log Log of crawl activity. Read about crawl in the Getting Data In Manual. Crawl is now deprecated.
django_access.log Django HTTP request log (equivalent to web_access.log) for the Django Bindings component of the Splunk Web Framework.
django_error.log Raw Django error output from Splunk Web Framework (not really meant to be human readable). Used with link on error screens to see the full error in Splunk Web.
django_service.log General Django related messages from Splunk Web Framework (equivalent to web_service.log)
export_metrics.log Log of metrics related to exporting data with Hadoop Connect.
first_install.log Shows version number.
inputs.log Inputs found by crawl. This log file will be empty unless you use the crawl command.
intentions.log Intentions activity. Read about intentions in the Developing Views and Apps for Splunk Web Manual.
license_audit.log Deprecated. Look at license_usage.log instead of here.
license_usage.log Indexed volume in bytes per pool, index, source, sourcetype, and host. Starting in 4.2, license_usage.log is available only on a Splunk license master.
metrics.log Contains periodic snapshots of Splunk performance and system data, including information about CPU usage by internal processors and queue usage in Splunk's data processing. The metrics.log file is a sampling of the top ten items in each category in 30 second intervals, based on the size of _raw. It can be used for limited analysis of volume trends for data inputs. For more information about metrics.log, look in Work with metrics.log in this manual as well as this Community Wiki post about metrics.log.
migration.log A log of events during install and migration. Specifies which files were altered during upgrade.
python.log Python events within Splunk. Useful for debugging REST endpoints, communication with splunkd, PDF Report Server App, Splunk Web display issues, sendmail (email alerts), and scripted inputs. With web_service.log, one of the few Splunk logs that uses "WARNING" instead of "WARN" for second most verbose logging level.
remote_searches.log Messages from StreamedSearch channel. This code is executed on the search peers when a search head makes a search request. So this file contains useful information on indexers regarding searches they're participating in.
scheduler.log All actions (successful or unsuccessful) performed by the splunkd search and alert scheduler. Typically, this shows scheduled search activity.
searches.log Beginning with Splunk 5, no longer used. Instead, use the following search syntax: | history. This shows all the searches that have been run, plus stats for the searches.
searchhistory.log No longer used.
splunkd.log The primary log written to by the Splunk server. May be requested by Splunk Support for troubleshooting purposes. Any stderr messages generated by scripted inputs, scripted search commands, and so on, are logged here.
splunkd_access.log Any action done from splunkd through the UI is logged here, including splunkweb, the CLI, all POST GET actions, deleted saved searches, and other programs accessing the REST endpoints. Also logs the time taken to respond to the requests. sourcetype="splunkd_access.log"
splunkd_stderr.log The Unix standard error device for the server. Typically this contains (for *nix) times of healthy start and stop events, as well as various errors like exceptions, assertions, and errors generated by libraries and the operating system.
splunkd_stdout.log The Unix standard output device for the server.
splunkd-utility.log This log is written to by the prereq-checking utils splunkd clone-prep-clear-config, splunkd validatedb, splunkd check-license, splunkd check-transforms-keys, and splunkd rest (for offline CLI). Each util logs Splunk version, some basic config, and current OS limits like max number of threads, and then messages specific to the util. Consult this log file when splunkd didn't start.
web_access.log Requests made of Splunk Web, in an Apache access_log format.
web_service.log Primary log written by splunkweb. Records actions made by splunkweb. This and python.log are the only logs that, in second most verbose logging level, write messages with "WARNING" instead of Splunk log files' usual "WARN."

Splunk search logs

Splunk also creates search logs. Note that these are not indexed to _internal.

Each search has its own directory for all information specific to the search, including its search logs. The search's directory is named with (among other parameters) the search_id. (Match a search to its search_id in audit.log.) You'll find the search directory in $SPLUNK_HOME/var/run/splunk/dispatch/.

If you have any long-running real-time searches, you might want to adjust the maximum size of your search logs. These logs are rotated when they reach a default maximum size of 10 MB. Splunk keeps up to five of them for each search, so the total log size for a search can conceivably grow as large as 30 MB.

Most searches are unlikely to generate logs anywhere near 10 MB in size; however, it can become an issue if you have ongoing real-time searches.

To adjust the log size, edit $SPLUNK_HOME/etc/log-searchprocess.cfg.

Debug mode

Splunk has a debugging parameter. Read about enabling debug logging in this manual.

Except where noted above, Splunk's internal logging levels are DEBUG INFO WARN ERROR FATAL (from most to least verbose).

Note: Running Splunk with debugging turned on outputs a large amount of information. Make sure you do not leave debugging on for any significant length of time.

Use Splunk Web to manage logs

To view and manage logs, you can use Splunk Web:

1. Navigate to Settings > System settings > System logging. This generates a list of log channels and their status.

2. To change the logging level for a particular log channel, click on that channel. This brings up a page specific to that channel.

3. On the log channel's page, you can change its logging level.

When you change the logging level, note the following:

  • The change is immediate and dynamic.
  • The change is not persistent; it goes away when Splunk is restarted.

Settings > System settings > System logging is meant only for dynamic and temporary changes to Splunk log files. For permanent changes, use $SPLUNK_HOME/etc/log.cfg instead.

Included data models

Splunk comes with two sample data models. These data models are constructed from Splunk's internal logs. By interacting with them, you can learn about Splunk's log files and about data models in one fell swoop.

To access the internal log data models, click Pivot. By default, you should see two data models, "Splunk's Internal Audit Logs - SAMPLE" and "Splunk's Internal Server Logs - SAMPLE."

Note that there is a known issue in the alerts section of the "Splunk's Internal Server Logs" data model.

Splunk on Splunk app
Enable debug logging

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters