Getting Data In

how to know sie in bytes for a multi line log event

rashi83
Path Finder

We have tons of data coming in a index and we want to see which app is taking more space.
Log events are multi line.
I tried this but it seems to work for single line event -
| eval bytes=len(_raw) | stats count AS Lines sum(bytes) AS Bytes by source

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...