Dashboards & Visualizations

Splunkd.log Moved to /var/log/splunk

hartfoml
Motivator

My splunkd.log file moved to ./var/log/splunk/ this file is recording a lot of unusual log entries and rolling over quite often. Attached is an image of the log files.

I have two questions.

1) How do I get the log files back to $SPLUNKHOME/var/log/splunk/...?
2) How do I stop the unusual log files from overwhelming?

Any help would be appreciated.

08-16-2013 10:54:40.379 -0500 INFO ExecProcessor - Ran script: python /opt/splunkf/splunk/etc/apps/dbx/bin/jbridge_server.py, took 228.6 milliseconds to run, 0 bytes read, exited with code 1
08-16-2013 10:54:40.611 -0500 INFO ExecProcessor - Ran script: python /opt/splunkf/splunk/etc/apps/dbx/bin/jbridge_server.py, took 230.7 milliseconds to run, 0 bytes read, exited with code 1
08-16-2013 10:54:40.840 -0500 INFO ExecProcessor - Ran script: python /opt/splunkf/splunk/etc/apps/dbx/bin/jbridge_server.py, took 227.9 milliseconds to run, 0 bytes read, exited with code 1
08-16-2013 10:54:40.992 -0500 WARN DateParserVerbose - A possible timestamp match (mojojojo:/vobstore/cots/vobs/dragon.vbs /vobs/cots/dragon mvfs uuid=95c728af.920211) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context="source::/etc/mtab|host::blade012|mtab-too_small|remoteport::56543"

Log Image File

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

You should check if your $SPLUNK_HOME/etc/log.cfg has not be modified (get a new one from a fresh install if needed)

and also check if you have an hardcoded definition of $SPLUNK_HOME in your $SPLUNK_HOME/etc/splunk-launch.conf

0 Karma

jgedeon120
Contributor

appender.A1.fileName=/var/log/splunk/splunkd.log, change to appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You may want to look at other entries.

0 Karma

hartfoml
Motivator

in the log.cfg I have this config

# $SPLUNK_HOME/var/log/splunk/splunkd_std...
appender.A1.fileName=/var/log/splunk/splunkd.log

in the splunk-launch.conf I have this config

SPLUNK_HOME=/opt/splunk
SPLUNK_BINDIP=X.X.X.X

yet the logs are in the "./var/log/splunk" not the "/opt/splunk/var/log/splunk"

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...