Splunk Search

How is the Size value on the job page calculated and logged in Splunk?


I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.

I checked:

| rest /services/search/jobs|table label  diskUsage

The diskUsage value was close but didnt match the Size value in the Job page.

In Introspection,

index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb

Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value.

Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.

Any help would be great!

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...