Getting Data In

how to disable the data for metrics.log ??

rakesh_498115
Motivator

Hi..

How can i disable / restrict the data to the metrics.log at forwarder level...can anyone pls help.
i have changed the sizes in log.cfg file but then i could the metrics data..

### appender.A3.fileName=${SPLUNK_HOME}/var/log/splunk/splunklogger.log
###
appender.license_usage=RollingFileAppender
appender.license_usage.fileName=${SPLUNK_HOME}/var/log/splunk/license_usage.log
appender.license_usage.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.license_usage.maxBackupIndex=1
appender.license_usage.layout=PatternLayout
appender.license_usage.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.LicenseUsage=INFO,license_usage
appender.A4=RollingFileAppender
appender.A4.fileName=${SPLUNK_HOME}/var/log/splunk/searchhistory.log
appender.A4.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.A4.maxBackupIndex=1
appender.A4.layout=PatternLayout
appender.A4.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.SearchHistory=INFO, A4
# metrics spews a lot of logs, let's not pollute the other files.
appender.metrics=RollingFileAppender
appender.metrics.fileName=${SPLUNK_HOME}/var/log/splunk/metrics.log
appender.metrics.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.metrics.maxBackupIndex=1
appender.metrics.layout=PatternLayout
appender.metrics.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.Metrics=INFO,metrics
category.StatusMgr=INFO,metrics
category.DeploymentMetrics=INFO,metrics
# audit logs go a separate file
appender.audittrail=RollingFileAppender
appender.audittrail.fileName=${SPLUNK_HOME}/var/log/splunk/audit.log
appender.audittrail.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.audittrail.maxBackupIndex=1
appender.audittrail.layout=PatternLayout
appender.audittrail.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.AuditLogger=INFO,audittrail
#Licence Audit
appender.licenseaudit=RollingFileAppender
appender.licenseaudit.fileName=${SPLUNK_HOME}/var/log/splunk/license_audit.log
appender.licenseaudit.layout=PatternLayout
appender.licenseaudit.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l} %-5p %c - %m%n
category.LicenseManager-Audit=INFO,licenseaudit
#splunkd http server acccess log
appender.accesslog=RollingFileAppender
appender.accesslog.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd_access.log
appender.accesslog.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.accesslog.maxBackupIndex=1
appender.accesslog.layout=PatternLayout
appender.accesslog.layout.ConversionPattern=%m%n
category.HTTPAccess=INFO,accesslog
#splunkd search scheduler log
appender.scheduler=RollingFileAppender
appender.scheduler.fileName=${SPLUNK_HOME}/var/log/splunk/scheduler.log
appender.scheduler.maxFileSize=5000000 # default: 25MB (specified in bytes).
appender.scheduler.maxBackupIndex=1
appender.scheduler.layout=PatternLayout
appender.scheduler.layout.ConversionPattern=%d{%m-%d-%Y %H:%M:%S.%l %z} %-5p %c - %m%n
category.SavedSplunker=INFO,scheduler
#
# define splunk python logging properties
Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

Have you seen this question about splunks internal log sizes?

Does it resolve your issue?

0 Karma

rakesh_498115
Motivator

hi dart .. can you pls help here..i have posted my log.cfg file

0 Karma

dart
Splunk Employee
Splunk Employee

Can you post your log.cfg?

0 Karma

rakesh_498115
Motivator

yeah dart..i have seen this info and updated the log.cfg file of both the forwader servers...but even then the metrics size from the forwarder for a day is showing as 2 GB .. :(...can you pls help here..wats wrong..

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...