Getting Data In

managing log.cfg through deployment server

dstaulcu
Builder

I am trying to minimize noise level (across WAN) by splunk to greatest degree possible..

With review of index=_internal source=splunkd, I see that each of my universal forwarders is forwarding lines from splunkd.log. This log file is very noisy with most components logging INFO level events by default. I want to change most of the logging levels to >= WARN.

I know this can be done by manually altering logging levels in .\etc\log.cfg. Does anyone have any experience managing this configuration as a deployment-app? I imagine it would be possible with deployment of a script to execute line changes.. Is this a bad idea?

inputs appreciated.

0 Karma
1 Solution

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

View solution in original post

dstaulcu
Builder

Here is how I plan to package that solution as an app:

Create a new app with following files:

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.bat

.\deployment-apps\UF-LogCfgMgr\bin\logcfg.vbs

.\deployment-apps\UF-LogCfgMgr\local\inputs.conf

12/28/2013 - Follow up. Method worked. Added condition to leave INFO logging levels to DEV/TEST deployment clients but to use WARN only for PROD deployment clients.

1/19/2013 - updated logcfg.vbs to use log-local.cfg construct, to further tweak logging levels, to, and to support x86 on x64. Supports windows only

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...