Splunk Tips and materials

• How to start/stop Splunk daemon.

Splunk@VM-Splunk:~$ sudo /opt/splunk/bin/splunk start

• How to check a status of Splunk daemon

Splunk@VM-Splunk:~$ sudo /opt/splunk/bin/splunk status
splunkd is running (PID: 2432).
splunk helpers are running (PIDs: 2433 2448 2563 2590 27364).

• How to check a receiving syslog data

put “source=”udp:514″ sourcetype=”cisco:ios” on the search box

I would like to monitor “/var/log/ ”

./splunk add monitor /var/log/

How to remove Splunk APP

1. Go to directory of Splunk deployment – /opt/splunk/etc/apps
2. Remove a folder is associated with the APP that you want to remove
   • rm -rf [app name]
3. Restart Splunk system from browser