Getting Data In

How to determine the average size of my indexed events?

Splunk Employee
Splunk Employee

It can sometimes be interesting to know the average event size for a given source or sourcetype. How can this be achieved?

1 Solution

Splunk Employee
Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

  • | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

  • | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

View solution in original post

Splunk Employee
Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

  • | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

  • | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

View solution in original post

Explorer

Thanks, rather than average how would you total it up? So I want total size of events for a particuliar sourcetype in an index? Thanks!

0 Karma

Splunk Employee
Splunk Employee

Instead of avg() you can use sum(), like so:
- | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!