https://community.splunk.com/t5/Splunk-Search/How-to-determine-amount-of-data-from-a-given-host/m-p/36403#M178550 <P>Been poking around and trying to figure out how to pull up how much data has been sent from a specific host.</P> <P>For example host 123 is sending CPU data every 10sec, how much data is that over the course of time = "X"</P> Wed, 25 Apr 2012 22:27:09 GMT mlevenson 2012-04-25T22:27:09Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-amount-of-data-from-a-given-host/m-p/36403#M178550 <P>Been poking around and trying to figure out how to pull up how much data has been sent from a specific host.</P> <P>For example host 123 is sending CPU data every 10sec, how much data is that over the course of time = "X"</P> Wed, 25 Apr 2012 22:27:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-amount-of-data-from-a-given-host/m-p/36403#M178550 mlevenson 2012-04-25T22:27:09Z https://community.splunk.com/t5/Splunk-Search/How-to-determine-amount-of-data-from-a-given-host/m-p/36404#M178551 <P>This should do it - this shows how much data has been indexed from various hosts</P> <PRE><CODE>index=_internal source=*metrics.log group="tcpin_connections" | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | stats sum(kb) as KB by sourceHost | eval KB = round(KB) </CODE></PRE> Wed, 25 Apr 2012 23:05:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-determine-amount-of-data-from-a-given-host/m-p/36404#M178551 lguinn2 2012-04-25T23:05:30Z