Installation

Move logs to another folder in Windows

prcm
New Member

In Windows, what is the procedure to move the logs from \Program Files\splunk\var\log\splunk to another drive?

Tags (1)
0 Karma

lguinn2
Legend

The locations where Splunk stores its log files are pretty much hard-coded in the following configuration files:

log-cmdline-debug.cfg
log-searchprocess.cfg
log-btool-debug.cfg log-cmdline.cfg
log-utility.cfg
log-btool.cfg
log-debug.cfg
log.cfg

By default, these configuration files will be found in \Program Files\splunk\etc on a Windows system.
For log.cfg, you can create a file called log-local.cfg that contains your changes.
For any of these files, you can make a backup copy and edit the files directly. Just be aware that your changes will probably be overwritten the next time you update Splunk (except for log-local.cfg).

If you change the configuration files, you will need to restart Splunk for your changes to take effect. And you may not be able to change all of the log files, just most of them.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!