topic Re: how to set the log size limit in Splunk Search

how to set the log size limit

johnsmithcy — Thu, 24 Jan 2019 04:00:45 GMT

how to set the log size limit? how to make automatic deletion for the log collected

dkeck — Thu, 24 Jan 2019 05:56:34 GMT

Hi,
In this log have a look at batch inputs. A batch input will delete the file you want to read afterwards.

What do you mean by log size? Are ww talking boit a splunk log like splunkd.log? Or are you referring to a log you want to monitor?

    [batch://<path>] 
    move_policy = sinkhole 
    <attrbute1> = <val1> 
    <attrbute2> = <val2>

johnsmithcy — Thu, 24 Jan 2019 06:11:44 GMT

referring to the log I want to monitor

dkeck — Thu, 24 Jan 2019 07:46:19 GMT

HI,

I think that depends on what you want to log. Why do you want to set the size?

Did you try batch:// input?

johnsmithcy — Thu, 24 Jan 2019 07:53:41 GMT

where is batch://input
I afraid the log size would be too big

dkeck — Thu, 24 Jan 2019 07:59:37 GMT

HI, splunk can handle logs with big size too. Depends more on your queue size and your network, how fast it will ingest the data.

You are monitoring with a universal forwarder?

You can set the batch input your self, in any inputs.conf in $SPLUNK_HOME/splunk/etc/apps

just create a new app with a local folder and within the local folder create an inputs.conf.

Then paste the code I gave you above and replace ://path with your file path. Then restart splunk.

mayurr98 — Thu, 24 Jan 2019 08:33:45 GMT

well it is possible, you can configure index size limit as the logs are stored in indexes.
have a look at this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Configureindexstoragesize

let me know if it helps!

dkeck — Sun, 27 Jan 2019 10:34:52 GMT

Was this helpfull?

woodcock — Sun, 27 Jan 2019 14:37:10 GMT

You can set the maximum event size with the TRUNCATE setting.