how can i monitor a file size

[steveskinner]

Hi,

How can i configure inputs.conf + dashboard to monitor a file size

i.e. if i have a file on the C drive called c:/Test/package.zip how can i see the size of this file through Splunk dashboard

Many Thanks

Steve

[inventsekar]

Please check this add-on...
File/Directory Information Input Add-on
The File Info add-on provides an input for indexing file meta-data (size, last modified dates, etc.) and indexing it in your Splunk instance to make it searchable.
https://splunkbase.splunk.com/app/2776/

Or, you might need to do scripted input.

Or, maybe, check this idea -
- finding the size of all events from the log and adding it.

on that Splunk Tutorial data, we have a file tutorialdata.zip:./www1/access.log and its size is 4.06 MB (4,262,086 bytes). thru this query, splunk shows its size as "4248458" (very close value, i think ;). approximately, i hope, its a good process)

source="tutorialdata.zip:./www1/access.log" | eval esize=len(_raw) | stats sum(esize) by sourcetype