Splunk Search

Is a Splunk heavy forwarder able to keep track of non indexed file size?

New Member

Hello Team,

I have heavy forwarder where am filtering 1GB file to 4MB and indexing, and now I want to get the actual file size in my search that is 1GB.

Is this possible in Splunk? If yes, how?

Note: I have a Splunk which gives me 4MB , that is indexed data, but not 4GB:

index=_internal source=*metrics* series="*my file path*" | stats sum(eval(kb/1024)) as Filesize by series | eval FilesizeMB=round(Filesize,2) | table series,FilesizeMB

Thank you in advance.

0 Karma



Currently you don´t have that data in splunk. You could use this app:


To index the full size of the file, and then in the query merge both values by path and filename


0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...