Refine your search:

I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm trying to also find the total size of the logs by source. Is this possible? I've tried using eval length=len(_raw), but that only gives the length of each individual log.

asked 14 Feb '11, 20:52

thepocketwade's gravatar image

thepocketwade
1651113
accept rate: 0%


One Answer:
* | eval l=len(_raw) | stats sum(l) count by source
link

answered 14 Feb '11, 21:10

Ron%20Naken's gravatar image

Ron Naken
4.1k3427
accept rate: 38%

Thanks, I knew it would turn out to be something simple I was missing

(15 Feb '11, 14:33) thepocketwade
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×399

Asked: 14 Feb '11, 20:52

Seen: 797 times

Last updated: 14 Feb '11, 21:10

Copyright © 2005-2012 Splunk Inc. All rights reserved.