topic Re: How can I check event size? in Getting Data In

How can I check event size?

chintan_shah — Fri, 11 Aug 2017 20:06:26 GMT

Hi,

Is there any way to determine which events takes a lot of storage/data? It will help me to bypass those events if required.

Re: How can I check event size?

lfedak_splunk — Fri, 11 Aug 2017 22:36:37 GMT

Hey @chintan_shah, did I edit your question correctly? Are you hoping to check your licensing limits? Or is this for your own storage capacity?

Re: How can I check event size?

mattymo — Tue, 29 Sep 2020 15:21:12 GMT

Hey chintan_shah!

Check out the meta woot! app on splunkbase.

It provides many must have views for Splunk Admins, including a licensing data model that show you license usage per event:

This will allow you to monitor how much license a sourcetype/index are using per event.

Once you narrow it down you can then use a search like this to investigate the raw events

index=_internal sourcetype="splunkd"
| eval eventSize=len(_raw)
| table eventSize _raw
| sort - eventSize

and append | stats max(eventSize), avg(eventSize), min(eventSize) to keep some high level stats on your data.

Re: How can I check event size?

manish_singh_77 — Tue, 24 Sep 2019 13:41:15 GMT

@mmodestino_splunk

I am trying to check the license usage consumption by event pattern and trying to create a report which would say which event patterns are consuming more license.