topic How is the Size value on the job page calculated and logged in Splunk? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-is-the-Size-value-on-the-job-page-calculated-and-logged-in/m-p/424598#M121758 <P>I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.</P> <P>I checked:</P> <PRE><CODE>| rest /services/search/jobs|table label diskUsage </CODE></PRE> <P>The diskUsage value was close but didnt match the Size value in the Job page.</P> <P>In Introspection,</P> <PRE><CODE>index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb </CODE></PRE> <P>Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value. </P> <P>Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.</P> <P>Any help would be great!</P> Wed, 30 Sep 2020 00:55:26 GMT amat 2020-09-30T00:55:26Z How is the Size value on the job page calculated and logged in Splunk? https://community.splunk.com/t5/Splunk-Search/How-is-the-Size-value-on-the-job-page-calculated-and-logged-in/m-p/424598#M121758 <P>I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.</P> <P>I checked:</P> <PRE><CODE>| rest /services/search/jobs|table label diskUsage </CODE></PRE> <P>The diskUsage value was close but didnt match the Size value in the Job page.</P> <P>In Introspection,</P> <PRE><CODE>index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb </CODE></PRE> <P>Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value. </P> <P>Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.</P> <P>Any help would be great!</P> Wed, 30 Sep 2020 00:55:26 GMT https://community.splunk.com/t5/Splunk-Search/How-is-the-Size-value-on-the-job-page-calculated-and-logged-in/m-p/424598#M121758 amat 2020-09-30T00:55:26Z