Splunk search for Size of Lookup File
Copy
| inputlookup <insert lookup file name>
| foreach *
[ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
| addtotals b_* fieldname=b
| stats sum(b) as b
| eval mb=b/1024/1024, gb=mb/1024
| fields b mb gb
NOTE: Replace with the actual name of your lookup file.
This search will calculate the approximate size of your lookup file in bytes, megabytes, and gigabytes. Useful for trying to estimate how big a lookup file in Splunk is.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment