Splunk Search

How to extract event raw size just like linecount

tpflicke
Path Finder

I frequently use the length of the raw data - more often than readily extracted fields punctuation and linecount

I do so be extracting the field in the query like

... | eval raw_length=len(_raw) | ...

What are the options to do this as a predefined field extraction at either search time or even index time?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You can do this with a 'calculated field' which is really just an eval command stuff into a config file. Stuff this into $SPLUNK_HOME/etc/system/local/props.conf:

[default]
EVAL-raw_length = len(_raw)

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You can do this with a 'calculated field' which is really just an eval command stuff into a config file. Stuff this into $SPLUNK_HOME/etc/system/local/props.conf:

[default]
EVAL-raw_length = len(_raw)

tpflicke
Path Finder

Thanks, exactly what I need.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...