Splunk Search

Is there any way that I can calculate the byte size for each field value based on count?

pavanae
Builder

I have a query as below

field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) | stats count by field_B

Which gives the result as follows

field_B count
abc 548464
def 546546
ghi 845654
jkl 694855
mno 354845

Now how to modify my query to get the number_of_bytes, MB like below

field_B count number_of_bytes MB
abc 548464 768723 768
def 546546 434555 456
ghi 845654 321545 321
jkl 694855 243445 267
mno 354845 645667 689

Is there any way that I can calculate the byte size for each field value based on count?

0 Karma

adonio
Ultra Champion

hello there,

hope i understand your question / requirement
try the following search:

index = YOUR_INDEX_HERE sourcetype = YOUR_SUORCETYPE_HERE
field_A!="A" AND (field_B="abc" OR field_B="def" OR field_B="ghi" OR field_B="jkl" OR field_B="mno" ) 
|s tats count by field_B
| eval event_size_bytes =  len(field_B)
| eval event_size_kb = event_size_bytes/1024
| eval event_size_mb = event_size_bytes_kb/1024/1024

hope it helps

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...