Splunk Search

how to to calculate average size of a syslog message for a particular source

pacifikn
Communicator

Hello dear All,

 

1* How to calculate average size of a syslog message for a particular source in GB using Splunk query?

2**  What easy formula to calculate EPS? 

Thank you in advance

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1) Perhaps this will get you started.  I expect you'll get zero as a result since the average size of a syslog message is a tiny fraction of a GB.

index=foo source="a/particular/source"
| eval size = len(_raw)
| eval size = size/1024/1024/1024
| stat avg(size) as AvgSize

2) Splunk calculates eps already.  Search for index=_internal eps=*

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Also, remember that that's what you get from the data already indexed by splunk. Indexed data can be already transformed, trimmed, anonymized or whatever compared to what was really sent by the source.

As a rough estimate that can be enough but it's worth noting that it doesn't have to be a precise calculation.

Also - especially with UDP, there can be events lost "in transfer" - sent by the source and not received properly by the receiver.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...