Getting Data In

How do you configure the inputs.conf with file size?

vinaykata
Path Finder

Hi all,

Is there any way that we can write an inputs.conf stanza with file size. I wanted to archive the files which have a size of 10 MB or more.

Ex:
[monitor://filePath\filename.json]
disabled = false
sourcetype = STname
archivefilesize >= 10Mb (somthing like this or any other way to whitelist or blacklist the files with file size)

Thank You All!!!

Tags (2)
0 Karma

pruthvikrishnap
Contributor
sendEventMaxSize = <integer>
* The maximum size, in bytes, that an fschange event can be for the input to
  send the full event to be indexed. 
* Limits the size of event data that the fschange input sends.
* This limits the size of indexed file data.
* Default: -1 (unlimited).

With this setting you can set the event size in inputs.conf

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

fschange has been deprecated for about half of Splunk's existence, and is unrelated to monitor inputs asked for.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

inputs.conf has no setting to discriminate based on file size.

Maybe there's a different way to achieve your underlying goals, specify them to find out.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

One challenge I would see is, Splunk would typically read a file in real-time. Until the file hit the 10MB point, Splunk would have now way of knowing if it would meet that mark.

You would most likely have to write a script, that looks for files in a directory, that are 10MB or larger. The script could then copy the file to another directory that Splunk was monitoring. You would also have to wait until the file is complete for this to work.

0 Karma

ddrillic
Ultra Champion

-- I wanted to archive the files ...

What would you expect Splunk to do with these large files?

0 Karma

vinaykata
Path Finder

Correction it is 10KB file, But still do we have any option like that indexing files with specific size.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!