Splunk Search

maximum file size?

Currently trying to index a 2.8Gb log cisco firewall log file. It doesn't seem to be progressing beyond saving over an hour. Splunks on a decent box and isn't under high load. What's the maximim file size supported?

Tags (3)

Thanks for the response. It never managed to add the file via the webpage save, however when I set it to index the location instead it worked with no issues.

0 Karma


I don't think there is a specific maximum file size, beyond the underlying operating system / filesystem limits. You might find use in amrit's filestatus tool, which gives a realtime view into Splunk's tailing processor. See http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ for where to find it and how to use it.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!