This will depend on what you've actually configured in terms of enabled Streams, enabled fields, etc.
Have you tried looking at the License Usage Report? The "Previous 30 days" tab plus "Split By Source/Source type" may offer the insight you need.
Hmm, odd. Our Monitor App doesn't have anything.
Manually running the search string (Inspect) doesn't work either. I wonder if we've configured this properly...
I'm now seeing "[subsearch]: No matching fields exist" at the top of splunk when I go to the License Usage page.
earliest=-1d@d latest=@d index=_internal source=*license_usage.log* type=Usage st=stream* | stats sum(b) AS Bytes by st | sort -Bytes
I just added "st=stream*" to only include data generated by stream.
Thanks. However, there is no type=Usage in any of the license_usage.logs in my index on any of the indexers or even the search head.
This may not be as accurate as the other methods, but as an alternative you can also just run a search on the raw events to get a feel for index usage:
source=stream* | eval l=len(_raw) | stats sum(l) as BytesSum | eval TotalMB=round(BytesSum/(1024*1024), 0) | fields - BytesSum
(for 1 day, use something like "Yesterday" or "Last 24 hours" for the search time range)
Sweet, exactly what I was looking for. I'll study the string and see what you did. Appreciate it!