I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm trying to also find the total size of the logs by source. Is this possible? I've tried using eval length=len(_raw), but that only gives the length of each individual log.
* | eval l=len(_raw) | stats sum(l) count by source
Thanks, I knew it would turn out to be something simple I was missing