Determines the number of bytes that this event internally uses in disk storage for the values, not counting the bytes for storing the field names. This does not include the RAM usage of an event during a query, implying that aggregated events will have a size of zero.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _eventSize Name of output field.

[a] Optional parameters use their default value unless explicitly set.

Note

The eventSize() function must be used before any aggregate function, otherwise the event size will not be returned as zero.

eventSize() Examples

Click + next to an example below to get the full details.

Search for Events by Size in Repository

Search for events of a certain size in a repository using eventSize() function

Track Event Size Within a Repository

Calculate the event size and report the relative size statistics for each event using eventSize() function