Find size (in bytes?) of search results

[thepocketwade]

I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm trying to also find the total size of the logs by source. Is this possible? I've tried using eval length=len(_raw), but that only gives the length of each individual log.

[Ron_Naken · Accepted solution]

* | eval l=len(_raw) | stats sum(l) count by source

[thepocketwade]

Thanks, I knew it would turn out to be something simple I was missing