Getting Data In

Is there a way to monitor the size of the files uploaded in Splunk?

clementros
Path Finder

Hi all,

Is there a way to monitor the size of log files that i upload on Splunk ?

0 Karma
1 Solution

FrankVl
Ultra Champion

I don't think Splunk explicitely logs the size of the files that are ingested, but if those files have unique names and those names are captured in the source field (which is the case by default for file monitor inputs), you could check the license usage by source. That should give a pretty good indication of the file size.

index="_internal" source="*license_usage.log" type=Usage
| stats sum(b) AS bytes by s

To narrow down the results, you could add some filtering for the source (s) field (e.g.s="*.log") in the first line depending on the patter of log file names for which you want to check the size.

View solution in original post

FrankVl
Ultra Champion

I don't think Splunk explicitely logs the size of the files that are ingested, but if those files have unique names and those names are captured in the source field (which is the case by default for file monitor inputs), you could check the license usage by source. That should give a pretty good indication of the file size.

index="_internal" source="*license_usage.log" type=Usage
| stats sum(b) AS bytes by s

To narrow down the results, you could add some filtering for the source (s) field (e.g.s="*.log") in the first line depending on the patter of log file names for which you want to check the size.

lakshman239
SplunkTrust
SplunkTrust

Yes, you can use the license usage search to know the size.

index=_internal source=*license_usage.log type=Usage idx= st= | eval GB=b/1024/1024/1024 | timechart sum(GB) by idx

You can change idx (index) and st to match the ones which you used.

0 Karma

whrg
Motivator

Hello @clementros,

I use the following search to list all sources and their corresponding license usage:

index=_internal source="*license_usage.log" type=usage | eval MB = b/1048576 | chart sum(MB) as sum_MB by s | eval sum_MB=round(sum_MB,0) | rename s as source | sort source

Set the search time picker accordingly.

It is also possible list license usage for all sourcetypes, all hosts and all indexes.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...