Getting Data In

How to determine the average size of my indexed events?

hexx
Splunk Employee
Splunk Employee

It can sometimes be interesting to know the average event size for a given source or sourcetype. How can this be achieved?

1 Solution

hexx
Splunk Employee
Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

  • | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

  • | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

View solution in original post

hexx
Splunk Employee
Splunk Employee

If you want to check the average size in bytes of your events broken down by sourcetype, you can run the following search :

  • | eval esize=len(_raw) | stats avg(esize) by sourcetype

Of course, feel free to replace "*" with a specific data set you want to study, and don't forget to adequately set the time frame of the search.

Here's the same search but also showing the 10th and 90th percentile for event size (in bytes) broken down by sourcetype :

  • | eval esize=len(_raw) | stats p10(esize), avg(esize), p90(esize) by sourcetype

To obtain this breakdown by source instead of sourcetype, just replace "by sourcetype" with "by source" at the end of the stats command.

mendesjo
Path Finder

Thanks, rather than average how would you total it up? So I want total size of events for a particuliar sourcetype in an index? Thanks!

0 Karma

mtulett_splunk
Splunk Employee
Splunk Employee

Instead of avg() you can use sum(), like so:
- | eval esize=len(_raw) | stats sum(esize) as bytes by sourcetype

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...