Getting Data In

is it possible to stop the indexing after source file reach some size ?

Path Finder

Hi ,

I would like to know, is there any way to stop the indexing if any specific source file grows 1 GB in size. Sometimes our logs growing very fast and it is affecting daily license usage limit in splunk. So we are planning to stop the files which is growing more than 1 GB. Please help me here?

Thanks!

Tags (3)
0 Karma

Contributor

A creative method :

  1. Create an alert to stop indexing for a sourcetype when the size reaches 1 GB.

index=internal source=*licenseusage.log type=Usage st="yoursourcetype"
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| where MB>1000
| fields st MB

  1. The action for this alert should be to trigger a script which will we got the config file and disable the source.
0 Karma

Path Finder

Hi,

Thanks for your reply, I am not sure how to get that script which get the config file and disable source. can you please help me on that? By that script are we going to disable the source or sourcetype? if it is source then it will disable which source?

0 Karma

Esteemed Legend

Everything that you can do from the GUI can be done with a CLI command using this:

$SPLUNK_HOME/bin/splunk edit monitor MyStanzaHeaderHere -disabled true
0 Karma

Path Finder

Hi ,

Thanks, let me try and update you.

0 Karma