Splunk Search
Highlighted

Find size (in bytes?) of search results

Path Finder

I'm running a search that compiles its results in a table by source and displays the number of logs per source. I'm trying to also find the total size of the logs by source. Is this possible? I've tried using eval length=len(_raw), but that only gives the length of each individual log.

Tags (1)
Highlighted

Re: Find size (in bytes?) of search results

Splunk Employee
Splunk Employee
* | eval l=len(_raw) | stats sum(l) count by source

View solution in original post

Highlighted

Re: Find size (in bytes?) of search results

Path Finder

Thanks, I knew it would turn out to be something simple I was missing

0 Karma