https://community.splunk.com/t5/Splunk-Search/Comparing-raw-data-volume-Vs-indexed-data-volume/m-p/402456#M167353 <P>To determine duplicate data, you could do a <CODE>| stats count by _raw, _time, host, source</CODE> although I promise that will be a slow and painful process.</P> <P>Indexed data volume is captured in <CODE>index=_internal source=*/license_usage.log sourcetype=splunkd</CODE> and then you can specify a sourcetype using the <CODE>st=</CODE> field.</P> <P>Where do you think you have duplication? Starting with the symptoms that motivated your question will help us be more surgical in what would otherwise be a very involved process.</P> Wed, 17 Oct 2018 18:51:28 GMT sloshburch 2018-10-17T18:51:28Z https://community.splunk.com/t5/Splunk-Search/Comparing-raw-data-volume-Vs-indexed-data-volume/m-p/402455#M167352 <P>How do i compare my raw data volume to the indexed data volume for a specific source type?</P> <P>Can someone help with this query?</P> <P>We have index clustering, a deployment server, and a distributed management console.</P> <P>i want to make sure their same data is not indexed more than one time. (dual, triple indexing of same data)</P> Fri, 28 Sep 2018 09:30:07 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-raw-data-volume-Vs-indexed-data-volume/m-p/402455#M167352 gnanaraj_mcc 2018-09-28T09:30:07Z https://community.splunk.com/t5/Splunk-Search/Comparing-raw-data-volume-Vs-indexed-data-volume/m-p/402456#M167353 <P>To determine duplicate data, you could do a <CODE>| stats count by _raw, _time, host, source</CODE> although I promise that will be a slow and painful process.</P> <P>Indexed data volume is captured in <CODE>index=_internal source=*/license_usage.log sourcetype=splunkd</CODE> and then you can specify a sourcetype using the <CODE>st=</CODE> field.</P> <P>Where do you think you have duplication? Starting with the symptoms that motivated your question will help us be more surgical in what would otherwise be a very involved process.</P> Wed, 17 Oct 2018 18:51:28 GMT https://community.splunk.com/t5/Splunk-Search/Comparing-raw-data-volume-Vs-indexed-data-volume/m-p/402456#M167353 sloshburch 2018-10-17T18:51:28Z