Getting Data In

## How to determine the average size of my indexed events?

Splunk Employee

It can sometimes be interesting to know the average event size for a given source or sourcetype. How can this be achieved?

Tags (4)
1 Solution
Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

• | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

• | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

• | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

• | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

Explorer

Thanks, rather than average how would you total it up? So I want total size of events for a particuliar sourcetype in an index? Thanks!

Splunk Employee

Instead of avg() you can use sum(), like so:
- | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype

State of Splunk Careers