https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182012#M52471 <P>Try this:</P> <PRE><CODE>index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize </CODE></PRE> Wed, 06 May 2015 19:30:34 GMT martin_mueller 2015-05-06T19:30:34Z https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182011#M52470 <P>I am trying to get the number of requests/response that we send/receive to/from one application and the combined size of request &amp; responses per hour.</P> <P>I am using the below query, but this doesn't seem to work.</P> <PRE><CODE>index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eventstats sum(raw_len), count by date_hour, Direction </CODE></PRE> <P>I need results in the below table format...</P> <P><STRONG>date.hour</STRONG> <STRONG>NumberofRequests(direction=REQUEST)</STRONG> <STRONG>Number of Responses (direction=RESPONSE) Sum(bytes)</STRONG></P> <P>Can someone please help me with this?<BR /> Thanks.</P> Wed, 06 May 2015 18:52:17 GMT https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182011#M52470 edookati 2015-05-06T18:52:17Z https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182012#M52471 <P>Try this:</P> <PRE><CODE>index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize </CODE></PRE> Wed, 06 May 2015 19:30:34 GMT https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182012#M52471 martin_mueller 2015-05-06T19:30:34Z https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182013#M52472 <P>great! it worked. Thanks a lot.</P> Wed, 06 May 2015 20:14:06 GMT https://community.splunk.com/t5/Splunk-Search/get-size-bytes-of-log-events-and-the-number-events-by-direction/m-p/182013#M52472 edookati 2015-05-06T20:14:06Z