Can i set a MAX MB or GB size per file?

[robertlynch2020]

Hi

I have an issues that every now again one sourcetype can produce lots of bad data into the TB, Splunk will then take it in.
Is there a way to say MAX data to be taken in from one file is 10MB or something like that, so i am not collecting all this bad data?

Thanks in advance
Robert

[richgalloway]

No, there is no such feature. Splunk would have no way of telling good data from bad so it accepts everything.

[robertlynch2020]

hi

Thanks for the answer.

I was more looking thinking from the the forwarder - to say 10 MB sent from one file so stop sending.

Regards
Robert Lynch

[richgalloway]

Still no such feature, but consider filing an Enhancement Request.