ansible-role-for-splunk icon indicating copy to clipboard operation
ansible-role-for-splunk copied to clipboard

Published 20 hours ago • verified publisher icon splunk

Change log level in cfg and CLI

Open arcsector opened this issue 1 year ago • 3 comments

Summary

Changes the log-level at the CLI level, then makes sure log-local.cfg exists, and adds or modifies the the log level in there. Requires the variables splunk_component and splunk_component_log_level provided to the task.

Modified files

  • Added: roles/tasks/adhoc_change_log_level.yml
  • Changed: README.md

arcsector avatar Jun 01 '23 18:06 arcsector

Made some changes to put the unfound items at the top of the file. Note that even if you set the file correctly, and the REST API shows you have set the log level correctly at /services/server/logger, Splunk still refuses to log at DEBUG for certain components (noticing this on an indexer with components HttpInputQueue, STMgr, TcpInputProc, and a couple other tests, but other components do work with this method like HttpInputDataHandler... Cmon Splunk!)

arcsector avatar Jun 06 '23 17:06 arcsector

@arcsector

  1. The splunk set log-level is not persistent, and is only used to change the level on a running instance temporarily.
  2. Can you add the option to configure multiple components to different levels in a loop?

jewnix avatar Jun 07 '23 22:06 jewnix

  1. Yes, this is the desired functionality, change the level now, and then do it persistently so a restart isn't necessary. I can remove the restart handle to reflect this.
  2. Done.

arcsector avatar Jun 08 '23 03:06 arcsector