how to limit one device 20MB logs data per day?

Hi Sir,

how to setup a index policy to limit one device per day logs size?

for example, I want to limit a device 20MB logs data per day. when the hot bucket stages reachs 20MB during one day, it will auto roll to warm stages, then the logs exceed 20MB incoming will be droped.

if the hot bucket stages don't reach 20MB during one day, it also will auto roll to warm stages, then create other hot bucket which limit 20MB logs data on the next day.

thanks...

index

asked 19 Jan '11, 06:55

dikaye
21●2
accept rate: 0%

I like this question. Very curious to see the responses.

(19 Jan '11, 13:55) Branden

seems no answer.

(09 Feb '11, 13:07) dikaye

Same question...probably a repost is needed

(03 Feb, 17:14) genemats

Be the first one to answer this question!

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

index ×299

Asked: 19 Jan '11, 06:55

Seen: 507 times

Last updated: 03 Feb, 17:14

how to limit one device 20MB logs data per day?

Follow this question

Splunk Resources

Related questions