Splunk Search

How can I change the debug level on a Universal Forwarder?

dwaddle
SplunkTrust
SplunkTrust

There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

View solution in original post

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

Masa
Splunk Employee
Splunk Employee

Since 4.2, splunk CLI can do it in this way;


bin/splunk set log-level FSChangeMonitor -level DEBUG

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...