https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15081#M1639 <P>Please see this Splunk Wiki table for more details, or to add your own events and their sizes now:</P> <P><A href="http://www.splunk.com/wiki/Community:CommonEventSizes" rel="nofollow">http://www.splunk.com/wiki/Community:CommonEventSizes</A></P> Mon, 14 Jun 2010 21:34:06 GMT maverick 2010-06-14T21:34:06Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15080#M1638 <P>I was wondering if anyone had a link to some web page that lists the sizes (in bytes) for various common IT data event source types, like Cisco ASA, Microsoft IIS, Bluecoat, WebSphere/WebLogic log4j or logback, insert_your_common_sourcetype_here, etc.</P> Tue, 08 Jun 2010 21:08:05 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15080#M1638 maverick 2010-06-08T21:08:05Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15081#M1639 <P>Please see this Splunk Wiki table for more details, or to add your own events and their sizes now:</P> <P><A href="http://www.splunk.com/wiki/Community:CommonEventSizes" rel="nofollow">http://www.splunk.com/wiki/Community:CommonEventSizes</A></P> Mon, 14 Jun 2010 21:34:06 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15081#M1639 maverick 2010-06-14T21:34:06Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15082#M1640 <P>If you want to check the average size in bytes of your events broken down by sourcetype, you can run the search below. Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search : </P> <UL> <LI>| eval esize=len(_raw) | stats avg(esize) by sourcetype</LI> </UL> Wed, 01 Sep 2010 02:58:10 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15082#M1640 hexx 2010-09-01T02:58:10Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15083#M1641 <P>Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :</P> <UL> <LI>| eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype</LI> </UL> Wed, 01 Sep 2010 02:58:48 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15083#M1641 hexx 2010-09-01T02:58:48Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15084#M1642 <P>Thanks! This will help a lot!</P> Wed, 01 Sep 2010 04:46:16 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15084#M1642 maverick 2010-09-01T04:46:16Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15085#M1643 <P>Isn't it simply the length of the _raw field? e.g. the value given by esize is only the number of characters.</P> Thu, 19 Feb 2015 15:00:11 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15085#M1643 effem 2015-02-19T15:00:11Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15086#M1644 <P>Any idea how you would find the TOTAL size of events by sourcetype in an index?</P> Mon, 03 Oct 2016 22:22:31 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-size-in-bytes-of-various-common-IT-data-event/m-p/15086#M1644 mendesjo 2016-10-03T22:22:31Z