How can I limit outputcsv file size?

[chris]

Is there a possibility to limit the filesize for csv files that are generated by the outputcsv command?

[BobM · Accepted solution]

if you precede the outputcsv command with the head command that will limit it for this search.

mysearch | head 1000 | ouputcsv mcsvfile.csv

or are you looking for a more global setting?

[chris]

Thanks. This is a good start, as a Splunk admin I'd prefer a to have a more global setting. I don't want to check every saved search and make sure, that they aren't storing _raw fields to csvs that are never used later on. I'll leave this open for a little while to see if there are any other ideas.