topic Re: Can I determine the size of a source without reading the entire source? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279942#M190491 <P>If it's already indexed (I can't tell from the post) you could use the license_usage.log to see how large the source was.</P> Mon, 13 Jun 2016 19:49:21 GMT sloshburch 2016-06-13T19:49:21Z Can I determine the size of a source without reading the entire source? https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279939#M190488 <P>Hi,</P> <P>I'd like to determine the size of certain sources, but don't want the overhead of reading the entire file. Is there a way to do this?</P> Sun, 10 Apr 2016 17:17:50 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279939#M190488 a212830 2016-04-10T17:17:50Z Re: Can I determine the size of a source without reading the entire source? https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279940#M190489 <P>You can use a scripted input which will run frequently and capture and send file size to splunk.</P> Sun, 10 Apr 2016 17:44:16 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279940#M190489 somesoni2 2016-04-10T17:44:16Z Re: Can I determine the size of a source without reading the entire source? https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279941#M190490 <P>You need this app:</P> <P><A href="https://splunkbase.splunk.com/app/2776/">https://splunkbase.splunk.com/app/2776/</A></P> Sun, 10 Apr 2016 19:00:07 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279941#M190490 woodcock 2016-04-10T19:00:07Z Re: Can I determine the size of a source without reading the entire source? https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279942#M190491 <P>If it's already indexed (I can't tell from the post) you could use the license_usage.log to see how large the source was.</P> Mon, 13 Jun 2016 19:49:21 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-determine-the-size-of-a-source-without-reading-the-entire/m-p/279942#M190491 sloshburch 2016-06-13T19:49:21Z