Splunk Search

Is there any way that I can calculate the byte size for each field value based on count?

pavanae
Builder

I have a query as below

field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) | stats count by field_B

Which gives the result as follows

field_B count
abc 548464
def 546546
ghi 845654
jkl 694855
mno 354845

Now how to modify my query to get the number_of_bytes, MB like below

field_B count number_of_bytes MB
abc 548464 768723 768
def 546546 434555 456
ghi 845654 321545 321
jkl 694855 243445 267
mno 354845 645667 689

Is there any way that I can calculate the byte size for each field value based on count?

0 Karma

adonio
Ultra Champion

hello there,

hope i understand your question / requirement
try the following search:

index = YOUR_INDEX_HERE sourcetype = YOUR_SUORCETYPE_HERE
field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) 
|s tats count by field_B
| eval event_size_bytes =  len(field_B)
| eval event_size_kb = event_size_bytes/1024
| eval event_size_mb = event_size_bytes_kb/1024/1024

hope it helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...