topic Re: Monitor a log file in Splunk Dev

Monitor a log file

jip31 — Wed, 28 Mar 2018 13:44:55 GMT

I want to monitor a log file in "C:\Windows\Logs\CBS.log" in an SPL command
Is it possible with wineventlog or with anotherway please?
regards

Re: Monitor a log file

ravidudala — Wed, 28 Mar 2018 14:06:24 GMT

Hi,

If I understand your question - you want to ingest the file CBS.log .

If that is the case you can follow the instructions available in below Doc.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorfilesanddirectorieswithSplunkWeb

If not can you elaborate your question?

Thanks | RD

Re: Monitor a log file

jip31 — Wed, 28 Mar 2018 16:30:33 GMT

hi
no not to ingest directly
i have to check the size file of CBS.log" in an SPL command on many machines
if i see that this file is > to 1 GO i have to receive an email
what do you thing about this code?
source="C:\Windows\Logs\CBS.log" | eval esize=len(_raw) | stats sum(esize) by sourcetype
or do i need File/Directory Information Input Add-on?
Thanks