Splunk Search

How to get average event size...

Champion

Is there a quick way (metadata? tstats?) to get the average event size for my events? Querying every event would take forever...

0 Karma

Ultra Champion

license_usage.log shows the size of the events...I usually use that so long as none were skipped.

0 Karma

Motivator

If you wanted a quick and dirty method you could do some math on the metrics logs (# events / size) but the larger your environment the less I trust the metrics log /shrug.

0 Karma

Revered Legend

AFAIK, Size of raw data is not stored in any metadata/tsidx, so only option would be to query raw data. May be run for a smaller period to avoid very long running query.

your base search | eval size=len(_raw) | stats avg(size)

Influencer

Yep. Event size was important to my system at one point so I set-up an accelerated data model using the same eval you have shown above. With the ADM it's easy to grab stats based on sourcetype, source, index and/or host. Once the need passed, I disabled the acceleration.

0 Karma

Champion

Thanks. Is that bytes?

0 Karma

Revered Legend

Yes.......

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!