Splunk Search

How is the Size value on the job page calculated and logged in Splunk?


I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.

I checked:

| rest /services/search/jobs|table label  diskUsage

The diskUsage value was close but didnt match the Size value in the Job page.

In Introspection,

index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb

Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value.

Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.

Any help would be great!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!