Splunk Search

Find size (in bytes?) of search results

Path Finder

I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm trying to also find the total size of the logs by source. Is this possible? I've tried using eval length=len(_raw), but that only gives the length of each individual log.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee
* | eval l=len(_raw) | stats sum(l) count by source

View solution in original post

Splunk Employee
Splunk Employee
* | eval l=len(_raw) | stats sum(l) count by source

View solution in original post

Path Finder

Thanks, I knew it would turn out to be something simple I was missing

0 Karma