Splunk Search

size of a log event

sanju005ind
Communicator

is there a query to get the size of a log event (how big the event is inside splunk?) I know you can get index sizes, just want to try to break it up a bit more. I can't find a field that is "size of log entry".

Tags (1)
1 Solution

Lowell
Super Champion

You should be able to use the eval command with the len() function. So you could look at high and low markers per sourcetype with a search like this:

| eval raw_len=len(_raw) | stats p10(raw_len), p90(raw_len) by sourcetype

Note: You asked about the "size" of your event. However, the term "size" is a bit ambigious. This example shows you the number of characters in the _raw field, which can be different from the number of bytes used to store the _raw field in the case of unicode characters.)

View solution in original post

ckurtz
Path Finder

p10 and p90 return the 10th and 90th percentile values1

aymericbrun
Explorer

What does it returns exactly ? What are the columns p10 and p90 ?? Is it the size in Mo ?

0 Karma

Lowell
Super Champion

You should be able to use the eval command with the len() function. So you could look at high and low markers per sourcetype with a search like this:

| eval raw_len=len(_raw) | stats p10(raw_len), p90(raw_len) by sourcetype

Note: You asked about the "size" of your event. However, the term "size" is a bit ambigious. This example shows you the number of characters in the _raw field, which can be different from the number of bytes used to store the _raw field in the case of unicode characters.)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...