how to to calculate average size of a syslog message for a particular source

[pacifikn]

Hello dear All,

1* How to calculate average size of a syslog message for a particular source in GB using Splunk query?

2**  What easy formula to calculate EPS? 

Thank you in advance

[richgalloway]

1) Perhaps this will get you started.  I expect you'll get zero as a result since the average size of a syslog message is a tiny fraction of a GB.

index=foo source="a/particular/source"
| eval size = len(_raw)
| eval size = size/1024/1024/1024
| stat avg(size) as AvgSize

2) Splunk calculates eps already.  Search for index=_internal eps=*

[PickleRick]

Also, remember that that's what you get from the data already indexed by splunk. Indexed data can be already transformed, trimmed, anonymized or whatever compared to what was really sent by the source.

As a rough estimate that can be enough but it's worth noting that it doesn't have to be a precise calculation.

Also - especially with UDP, there can be events lost "in transfer" - sent by the source and not received properly by the receiver.