topic Re: How much data is ingested by a single sourcetype from defined host/clientname in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362039#M66009 <P>Not getting serverlist in prod... </P> Thu, 22 Jun 2017 22:04:48 GMT gagandeep_arora 2017-06-22T22:04:48Z How much data is ingested by a single sourcetype from defined host/clientname https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362037#M66007 <P>How much data in MB/GB is ingested by a single sourcetype from defined host/clientname</P> Thu, 22 Jun 2017 20:50:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362037#M66007 gagandeep_arora 2017-06-22T20:50:40Z Re: How much data is ingested by a single sourcetype from defined host/clientname https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362038#M66008 <P>Try this</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*license_usage.log type=Usage h=YourHostNameHere st=YourSourceTypeHere | stats sum(b) as usage by h st | eval usageMB=roung(usage/1024/1024,3) </CODE></PRE> Thu, 22 Jun 2017 21:42:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362038#M66008 somesoni2 2017-06-22T21:42:51Z Re: How much data is ingested by a single sourcetype from defined host/clientname https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362039#M66009 <P>Not getting serverlist in prod... </P> Thu, 22 Jun 2017 22:04:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362039#M66009 gagandeep_arora 2017-06-22T22:04:48Z Re: How much data is ingested by a single sourcetype from defined host/clientname https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362040#M66010 <P>Do want to mention a typo in the provided SPL. </P> <P>It should be: </P> <PRE><CODE> index=_internal sourcetype=splunkd source=*license_usage.log type=Usage h=YourHostNameHere st=YourSourceTypeHere | stats sum(b) as usage by h st | eval usageMB=round(usage/1024/1024,3) </CODE></PRE> Tue, 09 Jul 2019 19:40:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-much-data-is-ingested-by-a-single-sourcetype-from-defined/m-p/362040#M66010 jhaggard_splunk 2019-07-09T19:40:40Z