Archive

How can I change the debug level on a Universal Forwarder?

SplunkTrust
SplunkTrust

There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

View solution in original post

Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

View solution in original post

Splunk Employee
Splunk Employee

Since 4.2, splunk CLI can do it in this way;


bin/splunk set log-level FSChangeMonitor -level DEBUG