Splunk Search

How to get average event size...

a212830
Champion

Is there a quick way (metadata? tstats?) to get the average event size for my events? Querying every event would take forever...

0 Karma

sloshburch
Splunk Employee
Splunk Employee

license_usage.log shows the size of the events...I usually use that so long as none were skipped.

0 Karma

Runals
Motivator

If you wanted a quick and dirty method you could do some math on the metrics logs (# events / size) but the larger your environment the less I trust the metrics log /shrug.

0 Karma

somesoni2
Revered Legend

AFAIK, Size of raw data is not stored in any metadata/tsidx, so only option would be to query raw data. May be run for a smaller period to avoid very long running query.

your base search | eval size=len(_raw) | stats avg(size)

twinspop
Influencer

Yep. Event size was important to my system at one point so I set-up an accelerated data model using the same eval you have shown above. With the ADM it's easy to grab stats based on sourcetype, source, index and/or host. Once the need passed, I disabled the acceleration.

0 Karma

a212830
Champion

Thanks. Is that bytes?

0 Karma

somesoni2
Revered Legend

Yes.......

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...