how to limit one device 20MB logs data per day?

Path Finder

Hi Sir,

how to setup a index policy to limit one device per day logs size?

for example, I want to limit a device 20MB logs data per day. when the hot bucket stages reachs 20MB during one day, it will auto roll to warm stages, then the logs exceed 20MB incoming will be droped.

if the hot bucket stages don't reach 20MB during one day, it also will auto roll to warm stages, then create other hot bucket which limit 20MB logs data on the next day.


Tags (1)

Path Finder

I think you'd need the application to be able to log to one of 2 separate log files, on demand.
Then, set up an alert (based on indexed volume for the day) to switch logging (via an alert-triggered script) to the log file that is not being indexed by Splunk.
At midnight daily, fire another alert that will switch logging back to the log file that is being indexed.

Some Java app servers can switch log4j logging levels on demand (via API) without a need to stop/start the app.
I do this for DEBUG-level logging to a logfile (6 of them) that is not being indexed, that rolls over every hour.
So I have the last 6 hours of logs, if I ever need to load any of them manually into Splunk for on-demand analysis of what just happened, without exhausting my daily indexing limit.

Now, I'm tempted to write/automate the script that will do the switch...

0 Karma

Splunk Employee
Splunk Employee

No such feature exists, why would you ever drop data ?
Oh wait, the license volume.

The only hard way I see, is to have a props/transforms that trash the events, that you activate manually with a script once a certain volume is reach, then removed every day at midnight.

0 Karma


Same question...probably a repost is needed

0 Karma

Path Finder

seems no answer.

0 Karma


I like this question. Very curious to see the responses.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...