https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177544#M51052 <P>Thanks, exactly what I need.</P> Tue, 27 May 2014 08:19:04 GMT tpflicke 2014-05-27T08:19:04Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177542#M51050 <P>I frequently use the length of the raw data - more often than readily extracted fields punctuation and linecount</P> <P>I do so be extracting the field in the query like</P> <PRE><CODE>... | eval raw_length=len(_raw) | ... </CODE></PRE> <P>What are the options to do this as a predefined field extraction at either search time or even index time?</P> Sat, 24 May 2014 15:03:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177542#M51050 tpflicke 2014-05-24T15:03:58Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177543#M51051 <P>You can do this with a 'calculated field' which is really just an <CODE>eval</CODE> command stuff into a config file. Stuff this into <CODE>$SPLUNK_HOME/etc/system/local/props.conf</CODE>:</P> <PRE><CODE>[default] EVAL-raw_length = len(_raw) </CODE></PRE> Sat, 24 May 2014 23:45:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177543#M51051 dwaddle 2014-05-24T23:45:40Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177544#M51052 <P>Thanks, exactly what I need.</P> Tue, 27 May 2014 08:19:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-event-raw-size-just-like-linecount/m-p/177544#M51052 tpflicke 2014-05-27T08:19:04Z