I we would like to index these logs in a different directory (a directory other than the $SPLUNK_HOME/var/log/splunk).
Indexer splunkd.log* as splunk_indexer_logs
Indexer metrics.log* as splunk_indexer_metrics_logs
Universal Forwarder splunkd.log as splunk_forwarder_logs
Search Head splunkd.log as splunk_search_head_logs
You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:
I want to change the location of the splunkd.log and rename it. Look for the following entry:
appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log
You can change the location to something like: /var/log/splunk/splunk_indexer.log
Disclaimer
Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.
You can change the location of Splunk's internal log set by editing the #SPLUNK_HOME/etc/log.cfg file. For instance:
I want to change the location of the splunkd.log and rename it. Look for the following entry:
appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log
You can change the location to something like: /var/log/splunk/splunk_indexer.log
Disclaimer
Splunk Support does not advise to do this as it can have adverse effects. One of which is likely to be the disruption of indexing internal logs.