Getting Data In

Can i set a MAX MB or GB size per file?

robertlynch2020
Motivator

Hi

I have an issues that every now again one sourcetype can produce lots of bad data into the TB, Splunk will then take it in.
Is there a way to say MAX data to be taken in from one file is 10MB or something like that, so i am not collecting all this bad data?

Thanks in advance
Robert

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No, there is no such feature. Splunk would have no way of telling good data from bad so it accepts everything.

---
If this reply helps you, Karma would be appreciated.
0 Karma

robertlynch2020
Motivator

hi

Thanks for the answer.

I was more looking thinking from the the forwarder - to say 10 MB sent from one file so stop sending.

Regards
Robert Lynch

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Still no such feature, but consider filing an Enhancement Request.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...