How can I change the debug level on a Universal Forwarder?

[dwaddle]

There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?

[amrit · Accepted solution]

bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

[Masa]

Since 4.2, splunk CLI can do it in this way;


bin/splunk set log-level FSChangeMonitor -level DEBUG


[gkanapathy]

Note: http://docs.splunk.com/Documentation/Splunk/4.2.4/Troubleshooting/Enabledebuglogging#Enable_debug_me...