https://community.splunk.com/t5/Getting-Data-In/Rotating-clearing-out-the-Universal-Forwarder-s-log-files/m-p/46211#M8706 <P>You can manipulate the configuration of the internal logging with the splunk/etc/log.cfg file. See this post, and the reference document it includes. <BR /> You can also make changes in Manager, but these changes are not persistent - they well go away after a Splunk restart.</P> <P><A href="http://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs">http://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs</A></P> Mon, 26 Aug 2013 14:28:52 GMT lukejadamec 2013-08-26T14:28:52Z https://community.splunk.com/t5/Getting-Data-In/Rotating-clearing-out-the-Universal-Forwarder-s-log-files/m-p/46210#M8705 <P>Part of the configuration we send to all of our Universal Forwarders instructs them to also send along their log files in $SPLUNK_HOME/var/log/splunk to the _internal index.</P> <P>As such, we don't need/want to keep historical logs in that directory. Right now they're just taking up disk space.</P> <P>Is there a configuration option on the Universal Forwarder we can set that'll have Splunk delete the old logs upon rotation?</P> Mon, 26 Aug 2013 14:08:49 GMT https://community.splunk.com/t5/Getting-Data-In/Rotating-clearing-out-the-Universal-Forwarder-s-log-files/m-p/46210#M8705 Ricapar 2013-08-26T14:08:49Z https://community.splunk.com/t5/Getting-Data-In/Rotating-clearing-out-the-Universal-Forwarder-s-log-files/m-p/46211#M8706 <P>You can manipulate the configuration of the internal logging with the splunk/etc/log.cfg file. See this post, and the reference document it includes. <BR /> You can also make changes in Manager, but these changes are not persistent - they well go away after a Splunk restart.</P> <P><A href="http://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs">http://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs</A></P> Mon, 26 Aug 2013 14:28:52 GMT https://community.splunk.com/t5/Getting-Data-In/Rotating-clearing-out-the-Universal-Forwarder-s-log-files/m-p/46211#M8706 lukejadamec 2013-08-26T14:28:52Z