Splunk Enterprise

I want to confirm its mb or kb

anil1432
Explorer

IMG-b8f8b6ee51be0f0a334859087a3783dd-V.jpg

 please can any one help me it's in kb or in mb ?

Thanks in advance 😊

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

neither, it's bytes

View solution in original post

0 Karma

anil1432
Explorer

Thank you very much I got

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your query does bytes=len(_raw) so it's bytes

 

0 Karma

anil1432
Explorer

It's in kb or in mb?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

neither, it's bytes

0 Karma

anil1432
Explorer

You mean 

It's bits or else bytes correct right

0 Karma

bowesmana
SplunkTrust
SplunkTrust

No, it's NOT bits - it is ONLY bytes, as defined by the statement

bytes = len(_raw)

1 character = 1 byte. If the line is 100 characters long it's 100 bytes. If you have 100 lines, each 100 lines long, it is 10,000 bytes. Your data

bowesmana_0-1624860995933.png

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...