Installation

Move logs to another folder in Windows

prcm
New Member

In Windows, what is the procedure to move the logs from \Program Files\splunk\var\log\splunk to another drive?

Tags (1)
0 Karma

lguinn2
Legend

The locations where Splunk stores its log files are pretty much hard-coded in the following configuration files:

log-cmdline-debug.cfg
log-searchprocess.cfg
log-btool-debug.cfg log-cmdline.cfg
log-utility.cfg
log-btool.cfg
log-debug.cfg
log.cfg

By default, these configuration files will be found in \Program Files\splunk\etc on a Windows system.
For log.cfg, you can create a file called log-local.cfg that contains your changes.
For any of these files, you can make a backup copy and edit the files directly. Just be aware that your changes will probably be overwritten the next time you update Splunk (except for log-local.cfg).

If you change the configuration files, you will need to restart Splunk for your changes to take effect. And you may not be able to change all of the log files, just most of them.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...