Rotating/clearing out the Universal Forwarder's log files

[Ricapar]

Part of the configuration we send to all of our Universal Forwarders instructs them to also send along their log files in $SPLUNK_HOME/var/log/splunk to the _internal index.

As such, we don't need/want to keep historical logs in that directory. Right now they're just taking up disk space.

Is there a configuration option on the Universal Forwarder we can set that'll have Splunk delete the old logs upon rotation?

[lukejadamec]

You can manipulate the configuration of the internal logging with the splunk/etc/log.cfg file. See this post, and the reference document it includes.
You can also make changes in Manager, but these changes are not persistent - they well go away after a Splunk restart.

http://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs