https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331501#M4882 <P>Try this (gives the amount of license used for indexes)</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3) </CODE></PRE> Fri, 09 Jun 2017 16:00:22 GMT somesoni2 2017-06-09T16:00:22Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331500#M4881 <P>I have spent hours today researching and testing all sort of searches and I just cannot figure out how to find the information I want. I would have thought it would have been straight forward to find the total volume of data sent to a specific index in MB.</P> <P>I have came close but only by experimenting with many examples I found on the site.</P> <P>Any advice would be very much appreciated. </P> <P>Thank you!</P> Fri, 09 Jun 2017 14:03:55 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331500#M4881 rleadingham 2017-06-09T14:03:55Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331501#M4882 <P>Try this (gives the amount of license used for indexes)</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3) </CODE></PRE> Fri, 09 Jun 2017 16:00:22 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331501#M4882 somesoni2 2017-06-09T16:00:22Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331502#M4883 <P>Setup a Monitoring Console:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview">https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview</A></P> Mon, 12 Jun 2017 05:58:34 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331502#M4883 woodcock 2017-06-12T05:58:34Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331503#M4884 <P>This is absolutely perfect thank you very much. I have what I am looking for and I have learnt more about how to query in Splunk!</P> Mon, 12 Jun 2017 06:35:15 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331503#M4884 rleadingham 2017-06-12T06:35:15Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331504#M4885 <P>How to check the daily indexing in such cases ? Would adding span=1d and a timechart help?</P> Wed, 04 Dec 2019 20:14:01 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331504#M4885 splunkdevabhi 2019-12-04T20:14:01Z https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331505#M4886 <P>If you want overall, then you can use this timechart version</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | timechart span=1d sum(b) as usage_mb| eval usage_mb=round(usage_mb/1024/1024,3) </CODE></PRE> <P>For per index, you can use this</P> <PRE><CODE> index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "&lt;&lt;FIELD&gt;&gt;"=round('&lt;&lt;FIELD&gt;&gt;'/1024/1024,3)] </CODE></PRE> <P>OR </P> <PRE><CODE> index=_internal sourcetype=splunkd source=*license_usage.log type=Usage | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval mb=round(bytes/1024/1024,3) </CODE></PRE> Wed, 04 Dec 2019 20:45:32 GMT https://community.splunk.com/t5/Splunk-Dev/Search-for-the-volume-of-data-ingested-into-a-specific-index-in/m-p/331505#M4886 somesoni2 2019-12-04T20:45:32Z