Splunk Search

How to request volume per source per day (time stamped, not indexed) ?

albasii
New Member

Many questions deal with indexed volume per source and per day for licence concern. My need is logs volume per source and per day. To explain more, I want to know the volume of each source without taking into account catching of old logs which could not be indexed in the past. So not the indexed volume per day but the volume of logs time stamped at a given day.

0 Karma

DavidHourani
Super Champion

Hi @albasii,

As you already know the data volume is directly linked to the event count for each sourcetype. An easy way to find volume change per sourcetype and per day is by using this base search :

 | tstats count WHERE index=* by _time,sourcetype

From there you can make a timechart and look for any weird changes in data ingestion.

 | tstats count as total WHERE index=* by _time,sourcetype | timechart sum(total) as total by sourcetype 

Hope this helps!

Cheers,
David

0 Karma

adonio
Ultra Champion

you can use the very inefficient ... | eval raw_size = len(_raw) | stats sum(raw_size) as total by source index
how many events you have that are old (over 24 hours) but are indexed "new" (24 hours or more later)?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...