Splunk Search

how to to calculate average size of a syslog message for a particular source

pacifikn
Communicator

Hello dear All,

 

1* How to calculate average size of a syslog message for a particular source in GB using Splunk query?

2**  What easy formula to calculate EPS? 

Thank you in advance

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1) Perhaps this will get you started.  I expect you'll get zero as a result since the average size of a syslog message is a tiny fraction of a GB.

index=foo source="a/particular/source"
| eval size = len(_raw)
| eval size = size/1024/1024/1024
| stat avg(size) as AvgSize

2) Splunk calculates eps already.  Search for index=_internal eps=*

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Also, remember that that's what you get from the data already indexed by splunk. Indexed data can be already transformed, trimmed, anonymized or whatever compared to what was really sent by the source.

As a rough estimate that can be enough but it's worth noting that it doesn't have to be a precise calculation.

Also - especially with UDP, there can be events lost "in transfer" - sent by the source and not received properly by the receiver.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...