Monitoring Splunk

It is safe to change all "maxBackupIndex" keys directly in /etc/log.cfg or there is a better way to achieve that goal?

linspec9721
Explorer

Hello folks,

I am new to splunk. We need to change log indexing from 5 to 3 on Splunk Enterprise for Windows. 

It is safe to change all "maxBackupIndex" keys directly in /etc/log.cfg or there is a better way to achieve that goal?

Thank you

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

the official way is to create local-log.cfg file where to do your local changes. Another way is use CLI like

splunk set log-level TailingProcessor -level DEBUG

https://docs.splunk.com/Documentation/Splunk/9.0.1/Troubleshooting/Enabledebuglogging

r. Ismo

View solution in original post

linspec9721
Explorer

ok thank you all

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I suppose it depends on what you mean by "safe".  Yes, you can do it without harming your Splunk installation.  Keep in mind a couple of things before you make the change: 1) you will be changing a delivered file so you will starting seeing "File Integrity" messages in Splunk; and 2) upgrading Splunk will overwrite your changes to log.cfg.

---
If this reply helps you, Karma would be appreciated.

isoutamo
SplunkTrust
SplunkTrust

Hi

the official way is to create local-log.cfg file where to do your local changes. Another way is use CLI like

splunk set log-level TailingProcessor -level DEBUG

https://docs.splunk.com/Documentation/Splunk/9.0.1/Troubleshooting/Enabledebuglogging

r. Ismo

Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...