https://community.splunk.com/t5/Getting-Data-In/log-file-size/m-p/393046#M70210 <P>Hello @premranjithj,</P> <P>I use the following search to list the top sources by size:</P> <PRE><CODE>index=_internal source="*license_usage.log" type=usage | eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | sort - sum_KB | head 10 | rename s as source </CODE></PRE> <P>Set the time picker accordingly, e.g. Last 24 hours.</P> <P>if you want those two specific sources then use:</P> <PRE><CODE>index=_internal source="*license_usage.log" type=usage (s="xx1.log" OR s="xx2.log") | eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | rename s as source </CODE></PRE> Mon, 08 Apr 2019 13:58:43 GMT whrg 2019-04-08T13:58:43Z https://community.splunk.com/t5/Getting-Data-In/log-file-size/m-p/393045#M70209 <P>How to calculate file size size which is indexed in splunk.</P> <P>For example<BR /> xx1.log<BR /> xx2.log<BR /> two files indexed at splunk and i want to calculate the size of the source after index.</P> Mon, 08 Apr 2019 13:36:33 GMT https://community.splunk.com/t5/Getting-Data-In/log-file-size/m-p/393045#M70209 DataOrg 2019-04-08T13:36:33Z https://community.splunk.com/t5/Getting-Data-In/log-file-size/m-p/393046#M70210 <P>Hello @premranjithj,</P> <P>I use the following search to list the top sources by size:</P> <PRE><CODE>index=_internal source="*license_usage.log" type=usage | eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | sort - sum_KB | head 10 | rename s as source </CODE></PRE> <P>Set the time picker accordingly, e.g. Last 24 hours.</P> <P>if you want those two specific sources then use:</P> <PRE><CODE>index=_internal source="*license_usage.log" type=usage (s="xx1.log" OR s="xx2.log") | eval KB= b/1024| chart sum(KB) as sum_KB by s | eval sum_KB=round(sum_KB,0) | rename s as source </CODE></PRE> Mon, 08 Apr 2019 13:58:43 GMT https://community.splunk.com/t5/Getting-Data-In/log-file-size/m-p/393046#M70210 whrg 2019-04-08T13:58:43Z