topic Re: Find Largest Files of Linux Using Splunk in Splunk Search

Find Largest Files of Linux Using Splunk

hishamjan — Thu, 25 Feb 2021 12:40:28 GMT

Hi everyone,

On my Linux machine, which has Splunk Forwarder and Splunk Add-on for Unix and Linux installed, I'm using this command to find the largest files on my server;

sudo du -a /var/log | sort -n -r | head -n 20

It enlists the first 20 largest files in the /var/log directory.

Now, I would like to do the same using Splunk.

Is there a way to edit the inputs.conf file to be able to index the data onto Splunk or is there any type or search I can make use of to achieve this.

Thanks in advance to anyone willing to help.

Reagards,

Hisham

Re: Find Largest Files of Linux Using Splunk

manjunathmeti — Thu, 25 Feb 2021 16:07:36 GMT

hi @hishamjan,

Enable the monitor for /var/log and set index in inputs.conf in the eadd-on.

[monitor:///var/log] disabled = 0 index = indexname

Search below query to get top files by size.

| tstats count where index="indexname" earliest=1 by source | sort -count | head 20

If this reply helps you, an upvote/like would be appreciated.

Re: Find Largest Files of Linux Using Splunk

hishamjan — Fri, 26 Feb 2021 07:56:16 GMT

Hi @manjunathmeti ,

Thanks for the reply,

I edited my inputs.conf file with;

[monitor://2>/dev/null]

index = monitor

disabled = false

(restarted splunk after that)

and my search with its result is attached below:

It isn't returning anything (All-Time, Last 24 hrs, Last 4 hours etc)...

Is there anything I'm doing wrong?

your help is appreciated.

Regards

Re: Find Largest Files of Linux Using Splunk

manjunathmeti — Fri, 26 Feb 2021 08:10:25 GMT

Your monitor path is not correct. It should be [monitor:///var/log].