Getting Data In

Can i set a MAX MB or GB size per file?

Motivator

Hi

I have an issues that every now again one sourcetype can produce lots of bad data into the TB, Splunk will then take it in.
Is there a way to say MAX data to be taken in from one file is 10MB or something like that, so i am not collecting all this bad data?

Thanks in advance
Robert

0 Karma

SplunkTrust
SplunkTrust

No, there is no such feature. Splunk would have no way of telling good data from bad so it accepts everything.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Motivator

hi

Thanks for the answer.

I was more looking thinking from the the forwarder - to say 10 MB sent from one file so stop sending.

Regards
Robert Lynch

0 Karma

SplunkTrust
SplunkTrust

Still no such feature, but consider filing an Enhancement Request.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!