Splunk Search

What is the best way to count events and calculate the disk space these events use?

cboillot
Contributor

So, the first part of this is really easy.

index=active_dir
| stats count by EventCode

This will give me the a list of all the event codes, and the number of times they appear. What I am needing to do, is also report on the total drive space those events, per event code, are taking up. Like this:

|EventCode |count |size on disk|
|EventCode_1|count_of_EventCode_1|size_on_disk_of_EventCode_1|
|EventCode_2|count_of_EventCode_2|size_on_disk_of_EventCode_2|
|EventCode_3|count_of_EventCode_3|size_on_disk_of_EventCode_3|

This is where I am stuck. Anyone have any ideas?

0 Karma
1 Solution

Rob2520
Communicator

Try this

index=active_dir| fields _raw | eval eventsize=len(_raw)| stats avg(eventsize) as average_size

This gives you average size in bytes.

View solution in original post

0 Karma

Rob2520
Communicator

Try this

index=active_dir| fields _raw | eval eventsize=len(_raw)| stats avg(eventsize) as average_size

This gives you average size in bytes.

0 Karma

cboillot
Contributor

Not quite, and I don't think I explained myself clearly. This is what i am needing:

|EventCode|count|size on disk|
|EventCode_1|count_of_EventCode_1|size_on_disk_of_EventCode_1
|EventCode_2|count_of_EventCode_2|size_on_disk_of_EventCode_2
|EventCode_3|count_of_EventCode_3|size_on_disk_of_EventCode_3

I tried to use both stats functions, but couldn't get it to work

index=ad_6mths
| fields _raw,EventCode
|  eval eventsize=len(_raw)| stats count by EventCode, sum(eventsize)
0 Karma

Rob2520
Communicator

Understood.

How about this?

index=ad_6mths| stats count as EventCodeCount by EventCode| join EventCode [ search index=ad_6mths| eval eventsize=len(_raw) | eval sizeinMB=round(eventsize/1024,2)| stats sum(sizeinMB) as TotalSizeinMB by EventCode]

This gives output in MB.

cboillot
Contributor

You sir, and the others like you, make this place a great place to be.

Thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...