topic Re: How can we find size of events in a particular duration? in Splunk Search

How can we find size of events in a particular duration?

rajgowd1 — Wed, 01 Feb 2017 22:49:32 GMT

Hi,
we are writing so many logs for application and all of them are indexed in Splunk. is there way to find the size of all events in a particular duration?

Re: How can we find size of events in a particular duration?

DalJeanis — Wed, 01 Feb 2017 23:00:38 GMT

By "the size of all events" are you asking "how much disk space does it take to index and store those events?"

Re: How can we find size of events in a particular duration?

rajgowd1 — Wed, 01 Feb 2017 23:04:02 GMT

i am looking for size of each event.

and it would be great,if we can get disk space for indexing.

and want find how amount of logging into Splunk

Re: How can we find size of events in a particular duration?

rajgowd1 — Wed, 01 Feb 2017 23:38:04 GMT

i am trying with this command but its failing

index=myindex| eval esize=len(_raw)|stats avg(esize) as avg [search index=myindex |stats count as co] | eval size=(avg*co)

Re: How can we find size of events in a particular duration?

mpreddy — Wed, 01 Feb 2017 23:46:14 GMT

Hi ,

Please give a try below command

| rest /services/data/indexes/

Re: How can we find size of events in a particular duration?

rajgowd1 — Wed, 01 Feb 2017 23:49:19 GMT

its not working.

Re: How can we find size of events in a particular duration?

rajgowd1 — Thu, 02 Feb 2017 01:06:27 GMT

i am able to get the size of events in in time duration,i used below search

Re: How can we find size of events in a particular duration?

mattlucas719 — Mon, 24 Jul 2017 17:34:03 GMT

I would actually clean it up and do like so:

index=whatever 
| fields _raw 
| eval esize=len(_raw) 
| stats count as count avg(esize) as avg 
| eval bytes=count*avg 
| eval kb=bytes/1024 
| eval mb=round(kb/1024/2014,2) 
| eval gb=round(kb/1024/1024/1024,2) 
| eval tb=round(gb/1024/1024/1024/1024,2) 
| stats values(kb) as KB, values(mb) AS MB, values(gb) AS GB, values(tb) AS TB

I added the ignore all fields except _raw to speed up the search
and i added the rounding for you

Re: How can we find size of events in a particular duration?

rmerrit — Mon, 16 Jul 2018 19:20:12 GMT

@mattlucas I think you have a typo in your eval mb line

| eval mb=round(kb/1024/2014,2)

should be

| eval mb=round(kb/1024/1024,2)

Re: How can we find size of events in a particular duration?

rmerrit — Mon, 16 Jul 2018 19:21:59 GMT

@mattlucas719

I think you have a typo in your eval mb line

| eval mb=round(kb/1024/2014,2)

Should be

| eval mb=round(kb/1024/1024,2)

Re: How can we find size of events in a particular duration?

mattlucas_gps — Mon, 16 Jul 2018 23:46:14 GMT

Yes, good catch. Typo on my part

Re: How can we find size of events in a particular duration?

agentsofshield — Mon, 27 Aug 2018 09:13:59 GMT

Your calculation is wrong for mb and onwards. it should be one 1024 less

Re: How can we find size of events in a particular duration?

sonny_monti — Wed, 10 Jul 2019 12:38:38 GMT

Very simple, by default splunk raw events are in UTF-8 format. This means that each character is 8 bits (one byte).

So you do this:

your initial search
| eval eventSize = len(_raw)/1024/1024/1024

the first division by 1024 gives you KiloBytes, the second division MegaBytes and the third GigaBytes and so on

Dont forget to upvote if you found this useful

Re: How can we find size of events in a particular duration?

xanthakita — Wed, 30 Sep 2020 01:24:02 GMT

as the kb is bytes 1024 mb is kb/1024 etc etc...