https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123362#M25467 <P>It is unclear but maybe you can get what you need from the <CODE>Data Summary</CODE>:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary</A></P> <P>Other than that you can run a search like this:</P> <PRE><CODE>index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host </CODE></PRE> Wed, 15 Jul 2015 14:08:22 GMT woodcock 2015-07-15T14:08:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123361#M25466 <P>I have multiple forwarders sending data into splunk index and I want to find size of each host sending data into splunk by forwarder.<BR /> Is there any way to calculate this.</P> Wed, 15 Jul 2015 12:34:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123361#M25466 vradhakrishnan 2015-07-15T12:34:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123362#M25467 <P>It is unclear but maybe you can get what you need from the <CODE>Data Summary</CODE>:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary</A></P> <P>Other than that you can run a search like this:</P> <PRE><CODE>index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host </CODE></PRE> Wed, 15 Jul 2015 14:08:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123362#M25467 woodcock 2015-07-15T14:08:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123363#M25468 <P>What's the purpose of "index=* AND index=_*" ? </P> Wed, 15 Jul 2015 20:11:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123363#M25468 ConnorG 2015-07-15T20:11:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123364#M25469 <P>My bad, it should be <CODE>OR</CODE>, not <CODE>AND</CODE>. I fixed it.</P> Wed, 15 Jul 2015 20:12:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123364#M25469 woodcock 2015-07-15T20:12:39Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123365#M25470 <P>woodcock you query is what I was look for thanks for your help.</P> Thu, 16 Jul 2015 05:04:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123365#M25470 vradhakrishnan 2015-07-16T05:04:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123366#M25471 <P>| stats sum(len) ? or sum(bytes)</P> Fri, 28 Jun 2019 07:40:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123366#M25471 CryoHydra 2019-06-28T07:40:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123367#M25472 <P>Another typo. Fixed.</P> Sat, 29 Jun 2019 16:22:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-splunk-data-size-injected-per-day-or-time-based/m-p/123367#M25472 woodcock 2019-06-29T16:22:57Z