Getting Data In
Highlighted

Can you track the size of a log file?

Explorer

I've been browsing around and was wondering is there a way to track a specific log file size (source)? The main reason I want to have an alert that if that files gets too big to have Splunk kick of a script to archive it. I really haven't been able to find a way to do this and was just wondering if anyone else has ran into this issue? Thanks everyone for your help.

0 Karma
Highlighted

Re: Can you track the size of a log file?

Legend

Hi @flyers777,
you could run a script that extract the size of files using a simple dir command (in Windows) or an ls -la command (in Linux) sending the output to Splunk, then you can run a search that compares values alerting it it reach a threeshold.

You can find infos at https://docs.splunk.com/Documentation/Splunk/8.0.1/AdvancedDev/ScriptSetup but in few words:

  • you have to create a script in $SPLUNKHOME/etc/apps/yourapp/bin e.g. called ls.sh (in Linux),
  • give to the script the correct execution rights,
  • create a stanza in inputs.conf to schedule script.

Ciao.
Giuseppe

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.