I saw a recommendation that Splunk works better with smaller log files. But what does "small" mean?
I would assume that 2GB is small, but maybe not? I can set log file rotation based on size or time, and I wanted to use size to optimize Splunk's ability to read the files...
I found a couple of other answers that touch on this subject, including one that says "there isn't really a max size except for file system limits." Okay for the maximum, but what is optimum? No one actually says "it's better if your log files don't exceed size X."
My take on this is that it might not be that Splunk work's better per se, but that it is better to setup smaller files through rotation by the fact that, since Splunk is indexing the contents of the files, you don't have to leave as much local on the system's disk.