Does Splunk store log files?

Question

Can anyone tell me where does Splunk store log files?

Answer 1

Yes, Splunk stores log files as indexed events in a proprietary database-like "index" in the location where Splunk is installed.

If you are looking for sizing information, it would be useful to visit the directory where your data is stored. Splunk contains several indexes (sometimes called "databases"). This is the location of your "main" index:

$SPLUNK_HOME/var/lib/splunk/defaultdb

If you are interested to learn Splunk from experienced instructors, I recommend this Splunk Training course by Intellipaat that provides Instructor-led training, hands-on projects, and certification.

 Also, watch this video on real-time log analytics using Splunk: