CODEWITHSUNDEEP
splunksplunk-querysplunk-formulasplunk-calculationsplunk-dashboard
MSC
MSC

Reputation: 1

Create a Splunk alert from a log file when a file with name hello.imp is below 10 bytes

I'm trying to write a Splunk query where it searches for a file called hello.imp from a log file and returns with a output if the file size is below 10 bytes. I have the index and log location but unable to find the exact query. Please help me out in a writing a query and creating an alert out of it.

Upvotes: 0

Views: 411

Answers (1)

RichG
RichG

Reputation: 9926

You can get the size of a source file by adding up the sizes of each event within that file. Like this:

index=foo source=bar
| eval size=len(_raw)
| stats sum(size) as TotalSize

Upvotes: 0

Related Questions