Splunk Search

size of a log event

sanju005ind
Communicator

is there a query to get the size of a log event (how big the event is inside splunk?) I know you can get index sizes, just want to try to break it up a bit more. I can't find a field that is "size of log entry".

Tags (1)
1 Solution

Lowell
Super Champion

You should be able to use the eval command with the len() function. So you could look at high and low markers per sourcetype with a search like this:

| eval raw_len=len(_raw) | stats p10(raw_len), p90(raw_len) by sourcetype

Note: You asked about the "size" of your event. However, the term "size" is a bit ambigious. This example shows you the number of characters in the _raw field, which can be different from the number of bytes used to store the _raw field in the case of unicode characters.)

View solution in original post

ckurtz
Path Finder

p10 and p90 return the 10th and 90th percentile values1

aymericbrun
Explorer

What does it returns exactly ? What are the columns p10 and p90 ?? Is it the size in Mo ?

0 Karma

Lowell
Super Champion

You should be able to use the eval command with the len() function. So you could look at high and low markers per sourcetype with a search like this:

| eval raw_len=len(_raw) | stats p10(raw_len), p90(raw_len) by sourcetype

Note: You asked about the "size" of your event. However, the term "size" is a bit ambigious. This example shows you the number of characters in the _raw field, which can be different from the number of bytes used to store the _raw field in the case of unicode characters.)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...