Splunk Search

How can I change the debug level on a Universal Forwarder?

dwaddle
SplunkTrust
SplunkTrust

There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

View solution in original post

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

Masa
Splunk Employee
Splunk Employee

Since 4.2, splunk CLI can do it in this way;


bin/splunk set log-level FSChangeMonitor -level DEBUG

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...