Knowledge Management

Can I change the location of Splunk's internal logs?

sgarvin55
Splunk Employee
Splunk Employee

I we would like to index these logs in a different directory (a directory other than the $SPLUNK_HOME/var/log/splunk).

Indexer splunkd.log* as splunk_indexer_logs
Indexer metrics.log* as splunk_indexer_metrics_logs
Universal Forwarder splunkd.log as splunk_forwarder_logs
Search Head splunkd.log as splunk_search_head_logs

Tags (1)
1 Solution

sgarvin55
Splunk Employee
Splunk Employee

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:

I want to change the location of the splunkd.log and rename it. Look for the following entry:

appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You can change the location to something like: /var/log/splunk/splunk_indexer.log

Disclaimer

Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.

View solution in original post

sgarvin55
Splunk Employee
Splunk Employee

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:

I want to change the location of the splunkd.log and rename it. Look for the following entry:

appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You can change the location to something like: /var/log/splunk/splunk_indexer.log

Disclaimer

Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!