Change data collection node capabilities and log levels

Change DCN capabilities

At the node level, hydra_node.conf contains the capabilities field. The Distributed Collection Scheduler sets the capabilities of the workers on the data collection nodes. You can change the capabilities for a node.

The capabilities in hydra_node.conf can be changed by the data collection node to only include certain tasks. For example, if two data collection nodes are specified in hydra_node.conf, one data collection node can require more power and more memory to process more intensive tasks than the other data collection node. The capabilities are specified by the following lines in hydra_node.conf:

[dcn1:8089]
capabilities = hostinv, vminv
[dcn2:8089]
capabilities = task, event

1. Create a local version of hydra_node.conf.
2. Edit $SPLUNK_HOME/etc/apps/local/hydra_node.conf on the scheduler node, which is typically the search head, to adjust the capabilities.

[default]

gateway_port = 8008

capabilities = * 


Change DCN log levels

To troubleshoot your environment, you can set the field worker_log_level in hydra_node.conf for a data collection node.

1. On the search head that administers the Distributed Collection Scheduler, create a local version of hydra_node.conf

2. Edit $SPLUNK_HOME/etc/apps/local/hydra_node.conf to set the log level of for all data collection nodes. The default log level for a data collection node is INFO. The most verbose logging level is DEBUG.

Example:

[default]

gateway_port = 8008

capabilities = * 

log_level = DEBUG