Hi
I have an issues that every now again one sourcetype can produce lots of bad data into the TB, Splunk will then take it in.
Is there a way to say MAX data to be taken in from one file is 10MB or something like that, so i am not collecting all this bad data?
Thanks in advance
Robert
No, there is no such feature. Splunk would have no way of telling good data from bad so it accepts everything.
hi
Thanks for the answer.
I was more looking thinking from the the forwarder - to say 10 MB sent from one file so stop sending.
Regards
Robert Lynch
Still no such feature, but consider filing an Enhancement Request.