We have tons of data coming in a index and we want to see which app is taking more space.
Log events are multi line.
I tried this but it seems to work for single line event -
| eval bytes=len(_raw) | stats count AS Lines sum(bytes) AS Bytes by source
