How do you configure the inputs.conf with file size?

[vinaykata]

Hi all,

Is there any way that we can write an inputs.conf stanza with file size. I wanted to archive the files which have a size of 10 MB or more.

Ex:
[monitor://filePath\filename.json]
disabled = false
sourcetype = STname
archivefilesize >= 10Mb (somthing like this or any other way to whitelist or blacklist the files with file size)

Thank You All!!!

[pruthvikrishnap]

sendEventMaxSize = <integer>
* The maximum size, in bytes, that an fschange event can be for the input to
  send the full event to be indexed. 
* Limits the size of event data that the fschange input sends.
* This limits the size of indexed file data.
* Default: -1 (unlimited).

With this setting you can set the event size in inputs.conf

[martin_mueller]

fschange has been deprecated for about half of Splunk's existence, and is unrelated to monitor inputs asked for.

[martin_mueller]

inputs.conf has no setting to discriminate based on file size.

Maybe there's a different way to achieve your underlying goals, specify them to find out.

[kmorris_splunk]

One challenge I would see is, Splunk would typically read a file in real-time. Until the file hit the 10MB point, Splunk would have now way of knowing if it would meet that mark.

You would most likely have to write a script, that looks for files in a directory, that are 10MB or larger. The script could then copy the file to another directory that Splunk was monitoring. You would also have to wait until the file is complete for this to work.

[ddrillic]

-- I wanted to archive the files ...

What would you expect Splunk to do with these large files?

[vinaykata]

Correction it is 10KB file, But still do we have any option like that indexing files with specific size.