Knowledge Management

Can I change the location of Splunk's internal logs?

sgarvin55
Splunk Employee
Splunk Employee

I we would like to index these logs in a different directory (a directory other than the $SPLUNK_HOME/var/log/splunk).

Indexer splunkd.log* as splunk_indexer_logs
Indexer metrics.log* as splunk_indexer_metrics_logs
Universal Forwarder splunkd.log as splunk_forwarder_logs
Search Head splunkd.log as splunk_search_head_logs

Tags (1)
1 Solution

sgarvin55
Splunk Employee
Splunk Employee

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:

I want to change the location of the splunkd.log and rename it. Look for the following entry:

appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You can change the location to something like: /var/log/splunk/splunk_indexer.log

Disclaimer

Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.

View solution in original post

sgarvin55
Splunk Employee
Splunk Employee

You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:

I want to change the location of the splunkd.log and rename it. Look for the following entry:

appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log

You can change the location to something like: /var/log/splunk/splunk_indexer.log

Disclaimer

Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...