It can sometimes be interesting to know the average event size for a given source or sourcetype. How can this be achieved?
If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :
Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.
Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :
To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.
If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :
Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.
Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :
To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.
Thanks, rather than average how would you total it up? So I want total size of events for a particuliar sourcetype in an index? Thanks!
Instead of avg() you can use sum(), like so:
- | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype