how can i get the line count(records) of a file without reading the complete file

[prakashbhanu407]

I need to get the records count only from a file , so is there a way without reading/indexing the complete file ?

[martin_mueller · Accepted solution]

Instead of indexing the entire file ( monitor:// input) you could build a scripted or modular input that looks at your file, computes the record count, outputs that record count into Splunk and index that.

[somesoni2]

In Splunk, (I hope)
Event count

| tstats count WHERE index=yourindex sourcetype=yoursourcetype source=filethatyouwantthecountfrom 

Line Count

your base search to select that file | stats sum(line_count) as linecount