Getting Data In

Can you track the size of a log file?

flyers777
Explorer

I've been browsing around and was wondering is there a way to track a specific log file size (source)? The main reason I want to have an alert that if that files gets too big to have Splunk kick of a script to archive it. I really haven't been able to find a way to do this and was just wondering if anyone else has ran into this issue? Thanks everyone for your help.

0 Karma

gcusello
Legend

Hi @flyers777,
you could run a script that extract the size of files using a simple dir command (in Windows) or an ls -la command (in Linux) sending the output to Splunk, then you can run a search that compares values alerting it it reach a threeshold.

You can find infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/AdvancedDev/ScriptSetup but in few words:

  • you have to create a script in $SPLUNK_HOME/etc/apps/your_app/bin e.g. called ls.sh (in Linux),
  • give to the script the correct execution rights,
  • create a stanza in inputs.conf to schedule script.

Ciao.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!