topic data ingest size from a server in Getting Data In

data ingest size from a server

jiaqya — Tue, 17 Apr 2018 15:56:15 GMT

how to identify data ingest size from a server per day...

looking to find sizes of data ingested from each server for planning ..

Re: data ingest size from a server

adonio — Tue, 17 Apr 2018 16:02:34 GMT

this is one way:

earliest=-1d@d latest=@d  index=_internal source=*license_usage.log* type=Usage
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| table h GB
| sort -GB

explore the data h stands for host
there are many many ways to get this data and quick search in this portal will prompt you to dozens of results
hope it helps

Re: data ingest size from a server

jiaqya — Tue, 17 Apr 2018 16:38:51 GMT

Adonio, thanks for your reply, unfortunately the query you gave returned 0 records.
i tried running this on the forwarder where i am inserting data via file inputs.

also i could not find any other document which can give me a ingest rate ..

Re: data ingest size from a server

adonio — Tue, 17 Apr 2018 16:49:33 GMT

are you an admin? or do you have admin role?
you are supposed to run queries on the Search Head

Re: data ingest size from a server

jiaqya — Tue, 17 Apr 2018 17:40:13 GMT

thanks, running it on search head gave me the result.

Re: data ingest size from a server

SamHTexas — Thu, 30 Sep 2021 20:44:44 GMT

Sir, how would I calculate he total amount of ingestion into an average server if only logs & small / Med DBs are ingested into the Splunk server? Thanks a million in advance.