How to determine the average size of my indexed events?

[hexx]

It can sometimes be interesting to know the average event size for a given source or sourcetype. How can this be achieved?

[hexx · Accepted solution]

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

• | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

• | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

[mendesjo]

Thanks, rather than average how would you total it up? So I want total size of events for a particuliar sourcetype in an index? Thanks!

[mtulett_splunk]

Instead of avg() you can use sum(), like so:
- | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype