I need to get the records count only from a file , so is there a way without reading/indexing the complete file ?
Instead of indexing the entire file ( monitor://
input) you could build a scripted or modular input that looks at your file, computes the record count, outputs that record count into Splunk and index that.
Instead of indexing the entire file ( monitor://
input) you could build a scripted or modular input that looks at your file, computes the record count, outputs that record count into Splunk and index that.
In Splunk, (I hope)
Event count
| tstats count WHERE index=yourindex sourcetype=yoursourcetype source=filethatyouwantthecountfrom
Line Count
your base search to select that file | stats sum(line_count) as linecount