https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103698#M1242 <P>Hello</P> <P>With the new settings Splunk will mantain only 2 files per log type, but it won´t delete the existing ones. So you need to delete manually the existing *.3 *.4 and *.5 files, to recover the used space</P> <P>Regards</P> Wed, 03 Dec 2014 11:14:53 GMT gfuente 2014-12-03T11:14:53Z https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103696#M1240 <P>I need to limit the disk usage on splunk's internal logs. (/opt/splunkforwarder/var/log/splunk). I've set the $SPLUNK_HOME/etc/log.cfg on the forwarder for ALL entries like this:</P> <PRE><CODE>xxxxx.XX.maxFileSize=10000000 # default: 25MB (specified in bytes). xxxxx.XX.maxBackupIndex=2 </CODE></PRE> <P>But I still have 5 metrics.log files and they're all 25MB after a splunk restart.</P> <P>Any idea when they rotate and/or how to force it?</P> Fri, 26 Oct 2012 13:03:29 GMT https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103696#M1240 glitchcowboy 2012-10-26T13:03:29Z https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103697#M1241 <P>This is a good question, can anyone please update us on this?</P> Tue, 05 Mar 2013 03:54:22 GMT https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103697#M1241 Dark_Ichigo 2013-03-05T03:54:22Z https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103698#M1242 <P>Hello</P> <P>With the new settings Splunk will mantain only 2 files per log type, but it won´t delete the existing ones. So you need to delete manually the existing *.3 *.4 and *.5 files, to recover the used space</P> <P>Regards</P> Wed, 03 Dec 2014 11:14:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/When-does-Splunk-roll-internal-logs/m-p/103698#M1242 gfuente 2014-12-03T11:14:53Z