How can internal logging levels in a Splunk environment be changed to troubleshoot an issue? (select all that apply)

Question

Options

• BUse Splunk command line.
• CUse Splunk Web.
• DEdit log-local. cfg.

Explanation

All three options - B, C, and D - are correct, as Splunk provides multiple methods for changing internal logging levels.

Why all three are correct:

• B (Splunk CLI): The command line supports splunk set log-level <component> <level>, which is useful for scripted or headless environments.
• C (Splunk Web): Under Settings > Server Controls, administrators can adjust logging levels through the UI without touching config files - the most accessible method.
• D (Edit log-local.cfg): Located at $SPLUNK_HOME/etc/log-local.cfg, this file is the correct override file for per-instance logging changes. Splunk reads it preferentially over the default log.cfg, making it the right file to edit directly.

Why there's no wrong distractor here: This is a "select all that apply" question testing whether candidates know that Splunk deliberately offers multiple equivalent paths to the same administrative task.

Memory tip: Think "CLI, Web, File" - Splunk almost always gives you three ways to configure something: command line, the Web UI, and direct config file editing. For logging specifically, remember the file is log-local.cfg (the local override), not log.cfg (the default you shouldn't touch).

No community discussion yet for this question.