size of a log event

Question

is there a query to get the size of a log event (how big the event is inside splunk?) I know you can get index sizes, just want to try to break it up a bit more. I can't find a field that is "size of log entry".

Accepted Answer

You should be able to use the eval command with the len() function. So you could look at high and low markers per sourcetype with a search like this:

| eval raw_len=len(_raw) | stats p10(raw_len), p90(raw_len) by sourcetype

Note: You asked about the "size" of your event. However, the term "size" is a bit ambigious. This example shows you the number of characters in the _raw field, which can be different from the number of bytes used to store the _raw field in the case of unicode characters.)

Answer 2

0	What does it returns exactly ? What are the columns p10 and p90 ?? Is it the size in Mo ? link answered 19 May '11, 08:48 aymericbrun 10●1●1●5 accept rate: 0%

size of a log event

Follow this question

Splunk Resources

Related questions