Can I change the location of Splunk's internal logs?

[sgarvin55]

I we would like to index these logs in a different directory (a directory other than the $SPLUNK_HOME/var/log/splunk).

Indexer splunkd.log* as splunk_indexer_logs
Indexer metrics.log* as splunk_indexer_metrics_logs
Universal Forwarder splunkd.log as splunk_forwarder_logs
Search Head splunkd.log as splunk_search_head_logs

[sgarvin55 · Accepted solution]

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:

I want to change the location of the splunkd.log and rename it. Look for the following entry:

appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You can change the location to something like: /var/log/splunk/splunk_indexer.log

Disclaimer

Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.