I am trying to have a column returned on a table that shows the bytes of each log entry (and maybe have a cumulative column too but thats irrelevant to this question)
I cannot figure out how to do this. I have read online there is a "bytes_in" field that can be extracted by I am unsure how to do that. I am using custom log files created by our devs here at my job. I see a "bytes" field when I do this query:
index=_internal bytes=*
But I am hoping there is a bytes field that can be extracted from every raw log file created with any custom query (like the mentioned "bytes_in" field above)
Can anyone give me any advice? Thanks!
You want the length of the raw event:
...your search... | eval bytes=len(_raw)
You want the length of the raw event:
...your search... | eval bytes=len(_raw)
It is a very close approximation to count the number of characters.
You may see differences between the original file and the events indexed of 1 byte per line on multiline events, as splunk does not index the linebreak of the events.
Thank you yannK.