What is the best way to count events and calculate the disk space these events use?

[cboillot]

So, the first part of this is really easy.

index=active_dir
| stats count by EventCode

This will give me the a list of all the event codes, and the number of times they appear. What I am needing to do, is also report on the total drive space those events, per event code, are taking up. Like this:

|EventCode |count |size on disk|
|EventCode_1|count_of_EventCode_1|size_on_disk_of_EventCode_1|
|EventCode_2|count_of_EventCode_2|size_on_disk_of_EventCode_2|
|EventCode_3|count_of_EventCode_3|size_on_disk_of_EventCode_3|

This is where I am stuck. Anyone have any ideas?

[Rob2520 · Accepted solution]

Try this

index=active_dir| fields _raw | eval eventsize=len(_raw)| stats avg(eventsize) as average_size

This gives you average size in bytes.

[cboillot]

Not quite, and I don't think I explained myself clearly. This is what i am needing:

|EventCode|count|size on disk|
|EventCode_1|count_of_EventCode_1|size_on_disk_of_EventCode_1
|EventCode_2|count_of_EventCode_2|size_on_disk_of_EventCode_2
|EventCode_3|count_of_EventCode_3|size_on_disk_of_EventCode_3

I tried to use both stats functions, but couldn't get it to work

index=ad_6mths
| fields _raw,EventCode
|  eval eventsize=len(_raw)| stats count by EventCode, sum(eventsize)

[Rob2520]

Understood.

How about this?

index=ad_6mths| stats count as EventCodeCount by EventCode| join EventCode [ search index=ad_6mths| eval eventsize=len(_raw) | eval sizeinMB=round(eventsize/1024,2)| stats sum(sizeinMB) as TotalSizeinMB by EventCode]

This gives output in MB.

[cboillot]

You sir, and the others like you, make this place a great place to be.

Thank you!