Splunk Search

How can I change the debug level on a Universal Forwarder?

dwaddle
SplunkTrust
SplunkTrust

There is a similar question related to changing debug levels at runtime. But, what if I'm doing this on a Universal Forwarder (which doesn't have manager to help me with this)? How would I enable/disable debug levels dynamically in that case?

Tags (1)
1 Solution

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

View solution in original post

amrit
Splunk Employee
Splunk Employee
bin/splunk _internal call /server/logger/FSChangeMonitor -post:level DEBUG

Replace FSChangeMonitor with whichever log level you'd like to change (see etc/log.cfg for some examples).

Masa
Splunk Employee
Splunk Employee

Since 4.2, splunk CLI can do it in this way;


bin/splunk set log-level FSChangeMonitor -level DEBUG

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...