https://community.splunk.com/t5/Getting-Data-In/How-accurate-is-using-the-eval-len-function-to-determine-volume/m-p/324124#M60334 <P>I've found char count close enough - I can't remember if the indexing is done before or after conversion to utf8, so it may not 100% match the license count - but for determining volume of a particular source that is not in your metrics log I've always found it useful. </P> <P>The metrics logs are the best way to measure, but depending on how many sources you have they may not be sampling the data you're after frequently enough. </P> Thu, 07 Dec 2017 15:32:55 GMT jplumsdaine22 2017-12-07T15:32:55Z https://community.splunk.com/t5/Getting-Data-In/How-accurate-is-using-the-eval-len-function-to-determine-volume/m-p/324123#M60333 <P>I know len counts the characters in a record, can we associate 1 character to 1 byte? Or is that highly inaccurate? </P> Thu, 07 Dec 2017 15:22:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-accurate-is-using-the-eval-len-function-to-determine-volume/m-p/324123#M60333 pbarbuto 2017-12-07T15:22:44Z https://community.splunk.com/t5/Getting-Data-In/How-accurate-is-using-the-eval-len-function-to-determine-volume/m-p/324124#M60334 <P>I've found char count close enough - I can't remember if the indexing is done before or after conversion to utf8, so it may not 100% match the license count - but for determining volume of a particular source that is not in your metrics log I've always found it useful. </P> <P>The metrics logs are the best way to measure, but depending on how many sources you have they may not be sampling the data you're after frequently enough. </P> Thu, 07 Dec 2017 15:32:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-accurate-is-using-the-eval-len-function-to-determine-volume/m-p/324124#M60334 jplumsdaine22 2017-12-07T15:32:55Z