Getting Data In

is it possible to stop the indexing after source file reach some size ?

Abilan1
Path Finder

Hi ,

I would like to know, is there any way to stop the indexing if any specific source file grows 1 GB in size. Sometimes our logs growing very fast and it is affecting daily license usage limit in splunk. So we are planning to stop the files which is growing more than 1 GB. Please help me here?

Thanks!

Tags (3)
0 Karma

jensonthottian
Contributor

A creative method :

  1. Create an alert to stop indexing for a sourcetype when the size reaches 1 GB.

index=_internal source=*license_usage.log type=Usage st="yoursourcetype"
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| where MB>1000
| fields st MB

  1. The action for this alert should be to trigger a script which will we got the config file and disable the source.
0 Karma

Abilan1
Path Finder

Hi,

Thanks for your reply, I am not sure how to get that script which get the config file and disable source. can you please help me on that? By that script are we going to disable the source or sourcetype? if it is source then it will disable which source?

0 Karma

woodcock
Esteemed Legend

Everything that you can do from the GUI can be done with a CLI command using this:

$SPLUNK_HOME/bin/splunk edit monitor MyStanzaHeaderHere -disabled true
0 Karma

Abilan1
Path Finder

Hi ,

Thanks, let me try and update you.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!