I'm trying to reduce space by reducing splunkd_access.log .4 & .5 as well as web_service.log .4 & .5 .
Doc is clear on metrics.log and I find that item in log.cfg . However this is not an exact match for web_service.log .
I did find an entry
appender.accesslog.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd_access.log
appender.accesslog.maxFileSize=25000000 # default: 25MB (specified in bytes).
appender.accesslog.maxBackupIndex=5 .
Hi cevyn,
you found the place to change it. You can put log.cfg
settings into a local file, log-local.cfg
file, residing in the same directory as log.cfg
. The settings in log-local.cfg
take precedence. And unlike log.cfg
, the log-local.cfg
file doesn't get overwritten on upgrade.
hope this helps ...
cheers, MuS
Thanks I did not pick up on that from any doc.
Do you have any ideas specifically on web_service.log since it does not seem to be listed in that file at all?
Maybe I was less than clear first time around because of trying to figure out how to enter the question.
How do I limit number of web_service.log down from 5 to 3? like th instruction for metric logs.
Is this really not documented somewhere?