topic Re: How do you configure the inputs.conf with file size? in Getting Data In

How do you configure the inputs.conf with file size?

vinaykata — Tue, 13 Nov 2018 19:51:45 GMT

Hi all,

Is there any way that we can write an inputs.conf stanza with file size. I wanted to archive the files which have a size of 10 MB or more.

Ex:
[monitor://filePath\filename.json]
disabled = false
sourcetype = STname
archivefilesize >= 10Mb (somthing like this or any other way to whitelist or blacklist the files with file size)

Thank You All!!!

Re: How do you configure the inputs.conf with file size?

ddrillic — Tue, 13 Nov 2018 20:32:47 GMT

-- I wanted to archive the files ...

What would you expect Splunk to do with these large files?

Re: How do you configure the inputs.conf with file size?

kmorris_splunk — Tue, 13 Nov 2018 20:51:17 GMT

One challenge I would see is, Splunk would typically read a file in real-time. Until the file hit the 10MB point, Splunk would have now way of knowing if it would meet that mark.

You would most likely have to write a script, that looks for files in a directory, that are 10MB or larger. The script could then copy the file to another directory that Splunk was monitoring. You would also have to wait until the file is complete for this to work.

Re: How do you configure the inputs.conf with file size?

vinaykata — Tue, 13 Nov 2018 20:56:58 GMT

Correction it is 10KB file, But still do we have any option like that indexing files with specific size.

Re: How do you configure the inputs.conf with file size?

martin_mueller — Tue, 13 Nov 2018 22:46:29 GMT

inputs.conf has no setting to discriminate based on file size.

Maybe there's a different way to achieve your underlying goals, specify them to find out.

Re: How do you configure the inputs.conf with file size?

pruthvikrishnap — Tue, 13 Nov 2018 23:35:26 GMT

sendEventMaxSize = <integer>
* The maximum size, in bytes, that an fschange event can be for the input to
  send the full event to be indexed. 
* Limits the size of event data that the fschange input sends.
* This limits the size of indexed file data.
* Default: -1 (unlimited).

With this setting you can set the event size in inputs.conf

Re: How do you configure the inputs.conf with file size?

martin_mueller — Wed, 14 Nov 2018 00:28:19 GMT

fschange has been deprecated for about half of Splunk's existence, and is unrelated to monitor inputs asked for.