Splunk Search

Is there any way that I can calculate the byte size for each field value based on count?

pavanae
Builder

I have a query as below

field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) | stats count by field_B

Which gives the result as follows

field_B count
abc 548464
def 546546
ghi 845654
jkl 694855
mno 354845

Now how to modify my query to get the number_of_bytes, MB like below

field_B count number_of_bytes MB
abc 548464 768723 768
def 546546 434555 456
ghi 845654 321545 321
jkl 694855 243445 267
mno 354845 645667 689

Is there any way that I can calculate the byte size for each field value based on count?

0 Karma

adonio
Ultra Champion

hello there,

hope i understand your question / requirement
try the following search:

index = YOUR_INDEX_HERE sourcetype = YOUR_SUORCETYPE_HERE
field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) 
|s tats count by field_B
| eval event_size_bytes =  len(field_B)
| eval event_size_kb = event_size_bytes/1024
| eval event_size_mb = event_size_bytes_kb/1024/1024

hope it helps

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...