Splunk Enterprise

I want to confirm its mb or kb

anil1432
Explorer

IMG-b8f8b6ee51be0f0a334859087a3783dd-V.jpg

 please can any one help me it's in kb or in mb ?

Thanks in advance 😊

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

neither, it's bytes

View solution in original post

0 Karma

anil1432
Explorer

Thank you very much I got

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your query does bytes=len(_raw) so it's bytes

 

0 Karma

anil1432
Explorer

It's in kb or in mb?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

neither, it's bytes

0 Karma

anil1432
Explorer

You mean 

It's bits or else bytes correct right

0 Karma

bowesmana
SplunkTrust
SplunkTrust

No, it's NOT bits - it is ONLY bytes, as defined by the statement

bytes = len(_raw)

1 character = 1 byte. If the line is 100 characters long it's 100 bytes. If you have 100 lines, each 100 lines long, it is 10,000 bytes. Your data

bowesmana_0-1624860995933.png

 

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...