Splunk Search

How to get average event size...

a212830
Champion

Is there a quick way (metadata? tstats?) to get the average event size for my events? Querying every event would take forever...

0 Karma

sloshburch
Splunk Employee
Splunk Employee

license_usage.log shows the size of the events...I usually use that so long as none were skipped.

0 Karma

Runals
Motivator

If you wanted a quick and dirty method you could do some math on the metrics logs (# events / size) but the larger your environment the less I trust the metrics log /shrug.

0 Karma

somesoni2
Revered Legend

AFAIK, Size of raw data is not stored in any metadata/tsidx, so only option would be to query raw data. May be run for a smaller period to avoid very long running query.

your base search | eval size=len(_raw) | stats avg(size)

twinspop
Influencer

Yep. Event size was important to my system at one point so I set-up an accelerated data model using the same eval you have shown above. With the ADM it's easy to grab stats based on sourcetype, source, index and/or host. Once the need passed, I disabled the acceleration.

0 Karma

a212830
Champion

Thanks. Is that bytes?

0 Karma

somesoni2
Revered Legend

Yes.......

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...