Splunk Search

How to get the min, average, max, median event size, standard deviation of event size by sourcetype

harishsplunk7
Explorer

How to Inspect each feed by different criteria:


Average ingestion rate per day, Minimum event size, 24 hour period
Average event size, 24 hour period, Maximum event size, 24 hour period, Median event size, 24 hour period
Standard Deviation of event size, 24 hour period based on sourcetype or source

Labels (6)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Most of those can be collected with three commands.  The rest depends on what is meant by "average ingestion rate" (what is being averaged over what period).

<<your search>>
| bin span=24h
| eval size=len(_raw)
| stats min(size) as MinEventSize, avg(size) as AvgEventSize, max(size) MaxEventSize, median(size) as MedianEventSize, stdev(size) as StdevEventSize by _time,sourcetype

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Most of those can be collected with three commands.  The rest depends on what is meant by "average ingestion rate" (what is being averaged over what period).

<<your search>>
| bin span=24h
| eval size=len(_raw)
| stats min(size) as MinEventSize, avg(size) as AvgEventSize, max(size) MaxEventSize, median(size) as MedianEventSize, stdev(size) as StdevEventSize by _time,sourcetype

 

---
If this reply helps you, Karma would be appreciated.

harishsplunk7
Explorer

When I look at the average and max size of the events, I see that the Max event size sometimes is exactly 300,000 bytes, which is suspicious. Please let me know did the event fields change ? if we receiving 10 events in one chunk of 300,000 bytes ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It could be the events are being truncated.  Check the TRUNCATE setting in the relevant props.conf stanza.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...