The locations where Splunk stores its log files are pretty much hard-coded in the following configuration files:
log-cmdline-debug.cfg
log-searchprocess.cfg
log-btool-debug.cfg log-cmdline.cfg
log-utility.cfg
log-btool.cfg
log-debug.cfg
log.cfg
By default, these configuration files will be found in \Program Files\splunk\etc on a Windows system.
For log.cfg, you can create a file called log-local.cfg that contains your changes.
For any of these files, you can make a backup copy and edit the files directly. Just be aware that your changes will probably be overwritten the next time you update Splunk (except for log-local.cfg).
If you change the configuration files, you will need to restart Splunk for your changes to take effect. And you may not be able to change all of the log files, just most of them.
