I am trying to figure out how the Size value in the Job page is calculated and where that is logged in splunk.
I checked:
| rest /services/search/jobs|table label diskUsage
The diskUsage value was close but didnt match the Size value in the Job page.
In Introspection,
index=_introspection | table _time data.search_props.user data.search_props.provenance data.elapsed data.mem_used data.search_props.user data.written_mb
Data.mem_used and data.written_mb seem to be close ( after adding the values since a job creates multiple events) but they also dont match the Size value.
Cant seem to find a way to locate that and create a report from it. I am basically trying to find a way to make a report showing user job history and the size of their jobs.
Any help would be great!
