https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259696#M96254 <P>Looks like we can manage splunkd-utility.log by changing parameter in log-utility.cfg.<BR /> Any how its 5 MB and will limit to 1 rotation than 5.</P> <P>appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd-utility.log</P> <P>appender.A1.maxFileSize=5000000 # default: 5MB (specified in bytes).</P> <P>appender.A1.maxBackupIndex=5</P> Wed, 19 Oct 2016 13:18:43 GMT anantdeshpande 2016-10-19T13:18:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259692#M96250 <P>Hi,<BR /> I have installed Splunk having very limited space. I am able to manage other logs my modifying /etc/log.cfg file.<BR /> However, do not find any parameter to rotate/control splunkd_stderr.log &amp; splunkd-utility.log.</P> <P>Do we have any separate parameter/file to manage these Splunk logs? </P> Wed, 19 Oct 2016 12:14:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259692#M96250 anantdeshpande 2016-10-19T12:14:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259693#M96251 <P>Hello,</P> <P>As you mentioned most logs can be controlled from /etc/log.cfg, however there are some logs such as splunkd_stderr.log that are effectively "hard coded" and cannot be changed. However, it was suggested that you could use a symbolic link to move the files to your preferred location.</P> <P>Reference:<BR /> <A href="https://answers.splunk.com/answers/9879/possible-to-move-splunks-log-folder-splunk-home-var-log-splunk.html">https://answers.splunk.com/answers/9879/possible-to-move-splunks-log-folder-splunk-home-var-log-splunk.html</A></P> <P>Best Regards,<BR /> BPitts2</P> Wed, 19 Oct 2016 13:00:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259693#M96251 bpitts2 2016-10-19T13:00:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259694#M96252 <P>Thank you,<BR /> As last solution will write script or create symbolic link.</P> Wed, 19 Oct 2016 13:15:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259694#M96252 anantdeshpande 2016-10-19T13:15:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259695#M96253 <P>For this specific index you can allocate (a lot) less than the 1/2 terabyte assigned, by default, for each index.</P> <P>To begin with, you can run the following to know how much each index consumes - </P> <PRE><CODE>| rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc </CODE></PRE> Wed, 19 Oct 2016 13:17:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259695#M96253 ddrillic 2016-10-19T13:17:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259696#M96254 <P>Looks like we can manage splunkd-utility.log by changing parameter in log-utility.cfg.<BR /> Any how its 5 MB and will limit to 1 rotation than 5.</P> <P>appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd-utility.log</P> <P>appender.A1.maxFileSize=5000000 # default: 5MB (specified in bytes).</P> <P>appender.A1.maxBackupIndex=5</P> Wed, 19 Oct 2016 13:18:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259696#M96254 anantdeshpande 2016-10-19T13:18:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259697#M96255 <P>I downvoted this post because this is a completely irrelevant answer.</P> Wed, 19 Oct 2016 13:19:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259697#M96255 bpitts2 2016-10-19T13:19:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259698#M96256 <P>Good to know, thanks!</P> Wed, 19 Oct 2016 13:20:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259698#M96256 bpitts2 2016-10-19T13:20:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259699#M96257 <P>Oh oh - really sorry ; -) but truly it's really relevant. </P> Wed, 19 Oct 2016 13:27:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259699#M96257 ddrillic 2016-10-19T13:27:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259700#M96258 <P>I agree. What is the point of decreasing the size of the log files if they are all indexed with a max size of 1/2 TB anyway?</P> Wed, 19 Oct 2016 13:30:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-control-splunk-logs-splunkd-stderr-log-splunkd-utility/m-p/259700#M96258 lukejadamec 2016-10-19T13:30:03Z