Upload large file

[mwdbhyat]

Hi,

How does one upload files larger than 500mb? I get an error "File too large. The file selected is 996Mb. Maximum file size is 500Mb" Is this due to using the trial ?

Thanks

[marnall]

For people finding this question in the years after 2016, you can set the max_upload_size setting in web.conf

[settings]
# set to the MB max
max_upload_size = 500
# you can also set a larger splunkdConnectionTimeout value so it wont timeout when uploading
splunkdConnectionTimeout=600

ref: https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/Webconf

[dbcase]

I've had the same problem. You can use the Linux SPLIT command to break the file up into smaller parts

http://askubuntu.com/questions/54579/how-to-split-larger-files-into-smaller-parts

[ChrisG]

Yes, both the trial and free licenses have an indexing limit of 500MB a day. For file upload on any license, the maximum file size is 500 MB, as the UI indicates.

[somesoni2 · Accepted solution]

The 500MB limit is for uploading file from Splunk Web, regardless of the license type.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Uploaddata

[mwdbhyat]

Thanks - Is there a way around this without using the Web, not splitting the file ?

[dbcase]

I don't think so but you could try using the universal forwarder instead of uploading the file

[dbcase]

Is it possible to zip the file so it is less than 500MB?

https://answers.splunk.com/answers/279/does-splunk-index-gzip-files.html

[mwdbhyat]

Figured it out with the CLI.. did a oneshot monitor. http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/MonitorfilesanddirectoriesusingtheCLI

[dbcase]

Ah good to know, haven't used that before