Create a Splunk alert from a log file when a file with name hello.imp is below 10 bytes

Question

I'm trying to write a Splunk query where it searches for a file called hello.imp from a log file and returns with a output if the file size is below 10 bytes. I have the index and log location but unable to find the exact query. Please help me out in a writing a query and creating an alert out of it.

Answer 1

You can get the size of a source file by adding up the sizes of each event within that file. Like this:

index=foo source=bar
| eval size=len(_raw)
| stats sum(size) as TotalSize