Hi,
I'd like to determine the size of certain sources, but don't want the overhead of reading the entire file. Is there a way to do this?
If it's already indexed (I can't tell from the post) you could use the license_usage.log to see how large the source was.
You need this app:
https://splunkbase.splunk.com/app/2776/
You can use a scripted input which will run frequently and capture and send file size to splunk.
