Getting Data In

log file size

DataOrg
Builder

How to calculate file size size which is indexed in splunk.

For example
xx1.log
xx2.log
two files indexed at splunk and i want to calculate the size of the source after index.

0 Karma
1 Solution

whrg
Motivator

Hello @premranjithj,

I use the following search to list the top sources by size:

index=_internal source="*license_usage.log" type=usage
| eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | sort - sum_KB
| head 10
| rename s as source

Set the time picker accordingly, e.g. Last 24 hours.

if you want those two specific sources then use:

index=_internal source="*license_usage.log" type=usage (s="xx1.log" OR s="xx2.log")
| eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0)
| rename s as source

View solution in original post

0 Karma

whrg
Motivator

Hello @premranjithj,

I use the following search to list the top sources by size:

index=_internal source="*license_usage.log" type=usage
| eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | sort - sum_KB
| head 10
| rename s as source

Set the time picker accordingly, e.g. Last 24 hours.

if you want those two specific sources then use:

index=_internal source="*license_usage.log" type=usage (s="xx1.log" OR s="xx2.log")
| eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0)
| rename s as source
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...