Is a Splunk heavy forwarder able to keep track of non indexed file size?

[snehalquintiles]

Hello Team,

I have heavy forwarder where am filtering 1GB file to 4MB and indexing, and now I want to get the actual file size in my search that is 1GB.

Is this possible in Splunk? If yes, how?

Note: I have a Splunk which gives me 4MB , that is indexed data, but not 4GB:

index=_internal source=*metrics* series="*my file path*" | stats sum(eval(kb/1024)) as Filesize by series | eval FilesizeMB=round(Filesize,2) | table series,FilesizeMB

Thank you in advance.

[gfuente]

Hello

Currently you don´t have that data in splunk. You could use this app:

https://splunkbase.splunk.com/app/2776/

To index the full size of the file, and then in the query merge both values by path and filename

Regards