Saturday, May 14, 2011

Splunk For Dummies

Splunk can be instrumental when it comes to aggregating and correlating data. However, like any tool there is a learning curve involved. Migrating away from Linux command line tools and learning something new when you're already pressed for time can slow the learning process. I've included a tidbit below that will help you get your data into splunk as quickly as possible.

Use the Sinkhole:
/opt/splunk/var/spool/splunk

Any data you move to this directory will be indexed by splunk and the original log files deleted. No modifying a GUI or adding a listener. Simply getting the data in splunk so that it can be searched quickly. Enjoy!

2 comments:

  1. interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts,Thanks a million once again, Regards,servicenow training in hyderabad ,splunk training in hyderabad ,

    ReplyDelete
  2. we are offering best devops online training with job support and high quality training facilities and well expert faculty .
    to Register you free demo please visit ,devops training in hyderabad

    ReplyDelete