Splunk Search

Is a Splunk heavy forwarder able to keep track of non indexed file size?

New Member

Hello Team,

I have heavy forwarder where am filtering 1GB file to 4MB and indexing, and now I want to get the actual file size in my search that is 1GB.

Is this possible in Splunk? If yes, how?

Note: I have a Splunk which gives me 4MB , that is indexed data, but not 4GB:

index=_internal source=*metrics* series="*my file path*" | stats sum(eval(kb/1024)) as Filesize by series | eval FilesizeMB=round(Filesize,2) | table series,FilesizeMB

Thank you in advance.

0 Karma



Currently you don´t have that data in splunk. You could use this app:


To index the full size of the file, and then in the query merge both values by path and filename


0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.