Please check this add-on...
File/Directory Information Input Add-on
The File Info add-on provides an input for indexing file meta-data (size, last modified dates, etc.) and indexing it in your Splunk instance to make it searchable.
https://splunkbase.splunk.com/app/2776/
Or, you might need to do scripted input.
Or, maybe, check this idea -
- finding the size of all events from the log and adding it.
on that Splunk Tutorial data, we have a file tutorialdata.zip:./www1/access.log and its size is 4.06 MB (4,262,086 bytes). thru this query, splunk shows its size as "4248458" (very close value, i think ;). approximately, i hope, its a good process)
source="tutorialdata.zip:./www1/access.log" | eval esize=len(_raw) | stats sum(esize) by sourcetype
