Scenario

During an incident investigation, you pulled a massive log export from /var/log/app/access.log that's several gigabytes in size. Your analysis tools and editors can't handle the entire file at once.

Task

You need to split it into smaller, more manageable chunks for parallel review. Create a directory /tmp/log_parts/ to store the split files, split /var/log/app/access.log into smaller files containing 100 lines each, name the output files sequentially with the prefix access_part_ (e.g., access_part_aa, access_part_ab, etc.), ensure the original log file remains untouched.

Example

# Before (single large log file)

/var/log/app/access.log: 375 lines, 2.5 GB
Cannot be opened by standard analysis tools

# After (log split into manageable chunks)

100 /tmp/log_parts/access_part_aa
100 /tmp/log_parts/access_part_ab
100 /tmp/log_parts/access_part_ac
 75 /tmp/log_parts/access_part_ad

375 total

Original file intact, 4 parts created for parallel analysis

Step 1: Create the directory to store split files

mkdir /tmp/log_parts/

Step 2: Verify the directory was created

ls -d /tmp/log_parts/

Step 3: Check how many lines are in the original log file

wc -l /var/log/app/access.log

Note the total number of lines in the output.

Step 4: Split the log file into 100-line chunks

split -l 100 /var/log/app/access.log /tmp/log_parts/access_part_

Step 5: List the files created in the directory

ls /tmp/log_parts/

You should see files named access_part_aa, access_part_ab, etc.