It is very important to keep track of Splunk's health status. Splunk Enterprise keeps logging various important information which can be helpful in the various stages of Splunk usage. Splunk's log and Splunk Enterprise can be used together to keep track of Splunk's health and various other important measures related to Splunk Enterprise. The Splunk logs can be useful in troubleshooting, system maintenance and tuning, and so on.
The following activities can be tracked by using Splunk's inbuilt logging mechanism:
Resource utilization and Splunk license usage
Data indexing, searching, analytics-related information, warnings, and errors
User activities and application usage information
Splunk component performance-related information
Splunk logging ranges from a wide variety of sources like audit log, kvstore log, conf log, crash log, license log, splunkd log, and many more.