topic Re: Setting a maximum limit on a monitored file in Getting Data In

Setting a maximum limit on a monitored file

genemats — Sat, 04 Feb 2012 01:48:40 GMT

We just had an application bug that spewed millions of duplicate messages into a Splunk monitored logfile. This caused a license violation to be triggered, before anyone could do anything about it.

In order to prevent this type of violation from happening we are considering putting a hard limit on the maximum logfile size Splunk can index. Most of our logfiles are normally apx < 300MB daily. So if we have a logfile that has > 500MB, we want to ignore anything else that is logged to the file after 500MB.

Is it possible to put such a hard byte limit on a monitored logfile or input source?

I've seen some answers that suggested putting a maxKBps datatransfer per second limit (in limits.conf), this one option, but perhaps some other option in Splunk could be used as well?

Re: Setting a maximum limit on a monitored file

svarun — Mon, 08 Apr 2013 05:53:15 GMT

Any updates here? I am facing the same issue.

Re: Setting a maximum limit on a monitored file

krish3 — Thu, 13 Mar 2014 17:31:02 GMT

Hi,

I have same situation i need to know is there a option for setting limit on a individual source or sourcetype??

thanks.

Re: Setting a maximum limit on a monitored file

tony_luu — Thu, 10 Apr 2014 18:55:00 GMT

same question here.