Determines the number of bytes that this event internally uses in disk storage for the values, not counting the bytes for storing the field names. This does not include the RAM usage of an event during a query, implying that aggregated events will have a size of zero.

asstringoptional[a]_eventSize Name of output field.

[a] Optional parameters use their default value unless explicitly set

eventSize() Examples

The example here searches for large events in the repository:

eventSize() | _eventSize > 10000

You cannot do a direct comparison, as the function augments the event data with the event size information, rather than returning data.