https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41626#M9644 <P>"index=_internal metrics group=per_host_thruput startdaysago=7 | rename series as host | tags | search tag::host=MyTags | bucket span=1d _time | stats sum(kb) as kb by date_mday" . This works for me.Is there any fine tuning to be done?</P> Mon, 28 Sep 2020 09:24:25 GMT sanju005ind 2020-09-28T09:24:25Z https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41623#M9641 <P>I would like to display the volume indexed from several indexed into following chart. </P> <UL> <LI>Past 24hrs log volume by time (line graph)</LI> <LI>Past week’s log volume (bar chart – bar for each day)</LI> </UL> <P>It should be Per Host combined since would be filtering the hosts by tags.</P> Wed, 09 Feb 2011 22:45:45 GMT https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41623#M9641 sanju005ind 2011-02-09T22:45:45Z https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41624#M9642 <P>earliest=-24h index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags | where tag=mytag | timechart span=1h sum(kb) by host</P> <PRE><CODE>earliest=-7d@d latest=@d index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags| where tag=mytag | timechart span=1d sum(kb) by host </CODE></PRE> Thu, 10 Feb 2011 00:12:35 GMT https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41624#M9642 gkanapathy 2011-02-10T00:12:35Z https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41625#M9643 <P>"index=_internal source=*metrics.log group=per_host_thruput | rename series as host | tags | search tag::host=mytag" this seems to work However when I check this I get very less hosts compared to "<BR /> | metadata type=hosts | TAGS | search tag::host=mytag | eval host=lower(host) | fields host| rename host as "series" | join <BR /> series[search index="_internal" source="*metrics.log" per_host_thruput | stats sum(kb) by series] "</P> Mon, 28 Sep 2020 09:24:23 GMT https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41625#M9643 sanju005ind 2020-09-28T09:24:23Z https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41626#M9644 <P>"index=_internal metrics group=per_host_thruput startdaysago=7 | rename series as host | tags | search tag::host=MyTags | bucket span=1d _time | stats sum(kb) as kb by date_mday" . This works for me.Is there any fine tuning to be done?</P> Mon, 28 Sep 2020 09:24:25 GMT https://community.splunk.com/t5/Splunk-Search/Log-Volume-Indexed/m-p/41626#M9644 sanju005ind 2020-09-28T09:24:25Z