Getting Data In

Deploy $SPLUNK_HOME/etc/log.cfg via deployment server?

ftk
Motivator

Is it possible to deploy $SPLUNK_HOME/etc/log.cfg via the deployment server to my forwarders? I wish to reduce the footprint of my Lightweight Forwarders by reducing the log sizes as mentioned here: http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

I am currently handling this at initial Splunk installation time, however would prefer to offload this on to the Splunk deployment server.

1 Solution

jrodman
Splunk Employee
Splunk Employee

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.

View solution in original post

dstaulcu
Builder

dcparker
Path Finder

did you ever get this solved?

0 Karma

Jason
Motivator

You could hack up deployment server to deploy to etc, but it only deploys "apps" and you probably wouldn't be able to deploy the exact file etc/log.cfg. Perhaps etc/something/local/log.cfg, but then Splunk wouldn't pick it up.

You could try symlinking etc/log.cfg to somewhere inside an app in etc/apps, then deploy that with DS, making sure to restart Splunk upon app install. That might work, but you would have to manage the symlink somehow.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Deployment server doesn't really do this, and the logging framework has to work before the bundle code starts up. I mean sure some chicken-and-egg engineering could be done with a bootstrap mode and a later runtime mode, but it's not a high payoff area compared to some others right now.

please do hit up support email with an Enhancement Request about that this matters to you folks. It gets raised now and then but I don't know if it gets through to product management.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...