Is there any way that I can calculate the byte size for each field value based on count?

pavanae — Tue, 29 Sep 2020 19:30:26 GMT

I have a query as below

field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) | stats count by field_B

Which gives the result as follows

field_B count
abc 548464
def 546546
ghi 845654
jkl 694855
mno 354845

Now how to modify my query to get the number_of_bytes, MB like below

field_B count number_of_bytes MB
abc 548464 768723 768
def 546546 434555 456
ghi 845654 321545 321
jkl 694855 243445 267
mno 354845 645667 689

Is there any way that I can calculate the byte size for each field value based on count?

Re: Is there any way that I can calculate the byte size for each field value based on count?

adonio — Wed, 09 May 2018 20:17:53 GMT

hello there,

hope i understand your question / requirement
try the following search:

index = YOUR_INDEX_HERE sourcetype = YOUR_SUORCETYPE_HERE
field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) 
|s tats count by field_B
| eval event_size_bytes =  len(field_B)
| eval event_size_kb = event_size_bytes/1024
| eval event_size_mb = event_size_bytes_kb/1024/1024

hope it helps

topic Re: Is there any way that I can calculate the byte size for each field value based on count? in Splunk Search

Is there any way that I can calculate the byte size for each field value based on count?

Re: Is there any way that I can calculate the byte size for each field value based on count?