There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG
Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG
Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).
Since 4.2, splunk CLI can do it in this way;
bin/splunk set log-level FSChangeMonitor -level DEBUG