I want to get the log size of each service in an index.This is my search string
index="hcg_oapi_prod"| eval size = len(_raw) | stats sum(size) as rawSize by sourcetype | eval GB = round(rawSize / 1024 / 1024/1024, 2)
But this query string can not be completed and auto-canceled.
Please help me.
I think you might be hitting some of the user search limits like the amount of memory it can consume.
I would try to switch from Verbose to Fast or specify the _raw field before your eval.
index="hcg_oapi_prod"| fields _raw| eval size = len(_raw)...
This should substantially speed the search up as it would not try to extract all the fields.