Enlist size of files and directories in acsending order

[hishamjan]

Hi,

Is there a way to enlist the size of files that are indexed using the local host and universal forwarders? 

From the above screenshot, I have 2 forwarders and fifteenforty is the search head. 

Is it possible to create a table of the largest files, smallest files, total files by each host or something close to that?

Any degree of help will be appreciated.

Regards,

Hisham

[richgalloway]

Try this query for starters.

index=foo
```Get the size of each event```
| eval bytes=len(_raw) 
```Add sizes by source and host```
| stats sum(bytes) as bytes by source,host 
```Get a count of files for each host```
| eventstats dc(source) as fileCount by host 
```Sort by host and size so we can find the largest and smallest files```
| sort - host bytes 
```Number the results```
| streamstats reset_on_change=1 count as rank by host 
```Get the highest number for each host```
| eventstats max(rank) as maxRank by host 
```Filter out all except the first and last 5 results```
```Change 5 to get a different number of largest or smallest files```
| where (rank<=5 OR rank>=maxRank-5) 
| table host fileCount source bytes

[hishamjan]

Hi @richgalloway 

Thanks for the response.

I tried this out but it gives a very vague data output.

What I'm precisely looking for is the largest files per host, i.e. if I have 6 hosts let's assume, I would want to know the largest file for every six hosts, their sizes as well as the name/path of that largest file.

Hope you understand what I'm looking for.

Regards, 

Hisham

[richgalloway]

"Is it possible to create a table of the largest files, smallest files, total files by each host or something close to that?"

"I would want to know the largest file for every six hosts, their sizes as well as the name/path of that largest file."

Thank you for changing the requirements.  I believe the existing answer has the information you need.  Just remove the parts you don't need.