I just want to keep the last 2 months / 60 days of my splunkd.log . Can I add it on logrotate.conf?
You could change the setting of the _internal index by adding these lines to your indexes.conf:
frozenTimePeriodInSecs = 5184000
This would keep everything in that index for longer than the usual month.
Alternatively, you could add a monitor to the splunkd.log to another index and keep those logs extra.
View solution in original post
Edit the log.conf in $SPLUNK_HOME/etc
The only issue is when you do an upgrade of Splunk, that file will get overwritten.