I received an alert from our monitoring system about disk space on our splunk server. Turns out, the ips_sdee.log files for the Splunk for Cisco IPS app are getting a tad large. They're obviously not rotating on their own. Is this correct? Should I be setting up rotation on my own? Presumably I can delete the existing files with no impact to splunk itself, right?
Im also struggling with this...
Would be good if
a) the logs were not collected at all... just imported straight to the index
b) the logs were located in the /var/log folder... and managed with normal unix logrotate...
anyone know how to do either of those things...?
thanks
Ok, turns out that restarting Splunk clears these logs. However, I don't make it a habit of restarting the server, so is there a way to make these logs rotate automagically?