https://community.splunk.com/t5/Getting-Data-In/Monitor-File-Size/m-p/93441#M19432 <P>Using a fschange input might be helpful here. By monitoring the file, and setting the option "sendEventMaxSize = N" then when the input checks the file, it will only send the contents of the file upto N bytes. If no content is sent, then you have progress. Not exactly what you are looking for, but without a perl/bash/python/etc script, I don't think it's possible. That is the other option, by the way. Write a scripted input to output the filesize of the file, and perform your search on that input.</P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem</A></CODE><BR /> <CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf</A></CODE></P> Wed, 17 Oct 2012 16:42:46 GMT alacercogitatus 2012-10-17T16:42:46Z https://community.splunk.com/t5/Getting-Data-In/Monitor-File-Size/m-p/93440#M19431 <P>My IDS system uses a file called snort.u2.xxxx.<BR /> this file roles over every night during a service restart and starts at 0 size after the restart of the service.<BR /> I have had a problem when the Snort service restarts that sometimes this file hangs.</P> <P>I want to be alerted if this file does not grow beyond a certain size in a given time.<BR /> Then I want the alert to restart the Snortd service and monitor again for a given time and size.</P> <P>Anyone have any ideas how I can do this</P> Wed, 17 Oct 2012 16:20:03 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-File-Size/m-p/93440#M19431 hartfoml 2012-10-17T16:20:03Z https://community.splunk.com/t5/Getting-Data-In/Monitor-File-Size/m-p/93441#M19432 <P>Using a fschange input might be helpful here. By monitoring the file, and setting the option "sendEventMaxSize = N" then when the input checks the file, it will only send the contents of the file upto N bytes. If no content is sent, then you have progress. Not exactly what you are looking for, but without a perl/bash/python/etc script, I don't think it's possible. That is the other option, by the way. Write a scripted input to output the filesize of the file, and perform your search on that input.</P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem</A></CODE><BR /> <CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/admin/inputsconf</A></CODE></P> Wed, 17 Oct 2012 16:42:46 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-File-Size/m-p/93441#M19432 alacercogitatus 2012-10-17T16:42:46Z