Splunk Search

how to set the log size limit

johnsmithcy
Path Finder

how to set the log size limit? how to make automatic deletion for the log collected

Tags (1)
0 Karma

woodcock
Esteemed Legend

You can set the maximum event size with the TRUNCATE setting.

0 Karma

mayurr98
Super Champion

Hi

well it is possible, you can configure index size limit as the logs are stored in indexes.
have a look at this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Configureindexstoragesize

let me know if it helps!

0 Karma

dkeck
Influencer

Hi,
In this log have a look at batch inputs. A batch input will delete the file you want to read afterwards.

What do you mean by log size? Are ww talking boit a splunk log like splunkd.log? Or are you referring to a log you want to monitor?

    [batch://<path>] 
    move_policy = sinkhole 
    <attrbute1> = <val1> 
    <attrbute2> = <val2>

https://docs.splunk.com/Documentation/SplunkCloud/7.1.3/Data/Monitorfilesanddirectorieswithinputs.co...

johnsmithcy
Path Finder

referring to the log I want to monitor

0 Karma

dkeck
Influencer

HI,

I think that depends on what you want to log. Why do you want to set the size?

Did you try batch:// input?

0 Karma

johnsmithcy
Path Finder

where is batch://input
I afraid the log size would be too big

0 Karma

dkeck
Influencer

HI, splunk can handle logs with big size too. Depends more on your queue size and your network, how fast it will ingest the data.

You are monitoring with a universal forwarder?

You can set the batch input your self, in any inputs.conf in $SPLUNK_HOME/splunk/etc/apps

just create a new app with a local folder and within the local folder create an inputs.conf.

Then paste the code I gave you above and replace ://path with your file path. Then restart splunk.

0 Karma

dkeck
Influencer

Was this helpfull?

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...