Is there any way that we can write an inputs.conf stanza with file size. I wanted to archive the files which have a size of 10 MB or more.
disabled = false
sourcetype = STname
archivefilesize >= 10Mb (somthing like this or any other way to whitelist or blacklist the files with file size)
Thank You All!!!
sendEventMaxSize = <integer> * The maximum size, in bytes, that an fschange event can be for the input to send the full event to be indexed. * Limits the size of event data that the fschange input sends. * This limits the size of indexed file data. * Default: -1 (unlimited).
With this setting you can set the event size in inputs.conf
One challenge I would see is, Splunk would typically read a file in real-time. Until the file hit the 10MB point, Splunk would have now way of knowing if it would meet that mark.
You would most likely have to write a script, that looks for files in a directory, that are 10MB or larger. The script could then copy the file to another directory that Splunk was monitoring. You would also have to wait until the file is complete for this to work.