Can I determine the size of a source without reading the entire source?

[a212830]

Hi,

I'd like to determine the size of certain sources, but don't want the overhead of reading the entire file. Is there a way to do this?

[sloshburch]

If it's already indexed (I can't tell from the post) you could use the license_usage.log to see how large the source was.

[woodcock]

You need this app:

https://splunkbase.splunk.com/app/2776/

[somesoni2]

You can use a scripted input which will run frequently and capture and send file size to splunk.