Getting Data In

Rotating/clearing out the Universal Forwarder's log files


Part of the configuration we send to all of our Universal Forwarders instructs them to also send along their log files in $SPLUNK_HOME/var/log/splunk to the _internal index.

As such, we don't need/want to keep historical logs in that directory. Right now they're just taking up disk space.

Is there a configuration option on the Universal Forwarder we can set that'll have Splunk delete the old logs upon rotation?

0 Karma

Super Champion

You can manipulate the configuration of the internal logging with the splunk/etc/log.cfg file. See this post, and the reference document it includes.
You can also make changes in Manager, but these changes are not persistent - they well go away after a Splunk restart.

Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...