I would look at this search. Assuming you are indexing single-byte data, I think it's pretty straightforward. Conversely if you have some multibyte logs in there it'll get a little harder because you cant assume each character is a single byte).
sourcetype=WinEventLog* | eval chars=len(_raw) | stats sum(chars) as bytes by sourcetype, EventCode | sort - bytes
That will give you the total bytes by EventCode, and also broken up by sourcetype.
(If you dont want the sourcetype, just do plain old 'by EventCode'.)
Or if you want a timechart showing volume by EventCode over time, you can switch to the "Advanced Charting" view and run this:
sourcetype=WinEventLog* | eval chars=len(_raw) | timechart sum(chars) by EventCode
and you'll probably want to switch the 'stack mode' to 'stacked' for this particular chart.
