Splunk Search

How is the Size value on the job page calculated and logged in Splunk?


I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.

I checked:

| rest /services/search/jobs|table label  diskUsage

The diskUsage value was close but didnt match the Size value in the Job page.

In Introspection,

index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb

Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value.

Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.

Any help would be great!

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...