Getting Data In

Can you track the size of a log file?


I've been browsing around and was wondering is there a way to track a specific log file size (source)? The main reason I want to have an alert that if that files gets too big to have Splunk kick of a script to archive it. I really haven't been able to find a way to do this and was just wondering if anyone else has ran into this issue? Thanks everyone for your help.

0 Karma

Re: Can you track the size of a log file?


Hi @flyers777,
you could run a script that extract the size of files using a simple dir command (in Windows) or an ls -la command (in Linux) sending the output to Splunk, then you can run a search that compares values alerting it it reach a threeshold.

You can find infos at but in few words:

  • you have to create a script in $SPLUNKHOME/etc/apps/yourapp/bin e.g. called (in Linux),
  • give to the script the correct execution rights,
  • create a stanza in inputs.conf to schedule script.


0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.