Splunk Search

how to set the log size limit

johnsmithcy
Path Finder

how to set the log size limit? how to make automatic deletion for the log collected

Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set the maximum event size with the TRUNCATE setting.

0 Karma

mayurr98
Super Champion

Hi

well it is possible, you can configure index size limit as the logs are stored in indexes.
have a look at this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Configureindexstoragesize

let me know if it helps!

0 Karma

dkeck
Influencer

Hi,
In this log have a look at batch inputs. A batch input will delete the file you want to read afterwards.

What do you mean by log size? Are ww talking boit a splunk log like splunkd.log? Or are you referring to a log you want to monitor?

    [batch://<path>] 
    move_policy = sinkhole 
    <attrbute1> = <val1> 
    <attrbute2> = <val2>

https://docs.splunk.com/Documentation/SplunkCloud/7.1.3/Data/Monitorfilesanddirectorieswithinputs.co...

johnsmithcy
Path Finder

referring to the log I want to monitor

0 Karma

dkeck
Influencer

HI,

I think that depends on what you want to log. Why do you want to set the size?

Did you try batch:// input?

0 Karma

johnsmithcy
Path Finder

where is batch://input
I afraid the log size would be too big

0 Karma

dkeck
Influencer

HI, splunk can handle logs with big size too. Depends more on your queue size and your network, how fast it will ingest the data.

You are monitoring with a universal forwarder?

You can set the batch input your self, in any inputs.conf in $SPLUNK_HOME/splunk/etc/apps

just create a new app with a local folder and within the local folder create an inputs.conf.

Then paste the code I gave you above and replace ://path with your file path. Then restart splunk.

0 Karma

dkeck
Influencer

Was this helpfull?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...