https://community.splunk.com/t5/Getting-Data-In/how-to-know-sie-in-bytes-for-a-multi-line-log-event/m-p/484699#M83000 <P>We have tons of data coming in a index and we want to see which app is taking more space. <BR /> Log events are multi line.<BR /> I tried this but it seems to work for single line event - <BR /> | eval bytes=len(_raw) | stats count AS Lines sum(bytes) AS Bytes by source</P> Fri, 20 Sep 2019 17:59:19 GMT rashi83 2019-09-20T17:59:19Z https://community.splunk.com/t5/Getting-Data-In/how-to-know-sie-in-bytes-for-a-multi-line-log-event/m-p/484699#M83000 <P>We have tons of data coming in a index and we want to see which app is taking more space. <BR /> Log events are multi line.<BR /> I tried this but it seems to work for single line event - <BR /> | eval bytes=len(_raw) | stats count AS Lines sum(bytes) AS Bytes by source</P> Fri, 20 Sep 2019 17:59:19 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-know-sie-in-bytes-for-a-multi-line-log-event/m-p/484699#M83000 rashi83 2019-09-20T17:59:19Z