Move logs to another folder in Windows

prcm — Fri, 09 May 2014 19:48:10 GMT

In Windows, what is the procedure to move the logs from \Program Files\splunk\var\log\splunk to another drive?

Re: Move logs to another folder in Windows

lguinn2 — Sat, 10 May 2014 01:28:07 GMT

The locations where Splunk stores its log files are pretty much hard-coded in the following configuration files:

log-cmdline-debug.cfg
log-searchprocess.cfg
log-btool-debug.cfg log-cmdline.cfg
log-utility.cfg
log-btool.cfg
log-debug.cfg
log.cfg

By default, these configuration files will be found in \Program Files\splunk\etc on a Windows system.
For log.cfg, you can create a file called log-local.cfg that contains your changes.
For any of these files, you can make a backup copy and edit the files directly. Just be aware that your changes will probably be overwritten the next time you update Splunk (except for log-local.cfg).

If you change the configuration files, you will need to restart Splunk for your changes to take effect. And you may not be able to change all of the log files, just most of them.

topic Move logs to another folder in Windows in Installation

Move logs to another folder in Windows

Re: Move logs to another folder in Windows