https://community.splunk.com/t5/Installation/How-to-find-which-sourcetype-is-sending-the-highest-logs-in-last/m-p/524623#M6793 <P>&nbsp;</P><LI-CODE lang="markup">index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB</LI-CODE><P>&nbsp;</P><P>Once you got the results, you can sort / filter them hourly, daily, weekly, etc.&nbsp;</P><P>&nbsp;</P><P><A href="https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume" target="_blank" rel="noopener">https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume</A></P><P>this page got license usage splunk search queries.</P> Wed, 14 Oct 2020 13:30:39 GMT inventsekar 2020-10-14T13:30:39Z https://community.splunk.com/t5/Installation/How-to-find-which-sourcetype-is-sending-the-highest-logs-in-last/m-p/524611#M6789 <P>Hi,</P><P>can someone please help ?</P><P>How to get the count or logs in gb/mb from particular sourcetype&nbsp; on indexer?</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 14 Oct 2020 13:05:57 GMT https://community.splunk.com/t5/Installation/How-to-find-which-sourcetype-is-sending-the-highest-logs-in-last/m-p/524611#M6789 pankajupadhyay 2020-10-14T13:05:57Z https://community.splunk.com/t5/Installation/How-to-find-which-sourcetype-is-sending-the-highest-logs-in-last/m-p/524623#M6793 <P>&nbsp;</P><LI-CODE lang="markup">index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | bin _time span=1d | stats sum(b) as b by _time, pool, indexname, sourcetypename | eval GB=round(b/1024/1024/1024, 3) | fields _time, indexname, sourcetypename, GB</LI-CODE><P>&nbsp;</P><P>Once you got the results, you can sort / filter them hourly, daily, weekly, etc.&nbsp;</P><P>&nbsp;</P><P><A href="https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume" target="_blank" rel="noopener">https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume</A></P><P>this page got license usage splunk search queries.</P> Wed, 14 Oct 2020 13:30:39 GMT https://community.splunk.com/t5/Installation/How-to-find-which-sourcetype-is-sending-the-highest-logs-in-last/m-p/524623#M6793 inventsekar 2020-10-14T13:30:39Z