Help to find daily indexed data size by each index

[dhavamanis]

Need your help,

Can you please tell us, how to find daily indexed data size by each index?

[ppablo · Accepted solution]

Hi @dhavamanis

There are large number of the same, if not similar, question already posted on Answers. Do the search(es) in this post answer your question? There's an option per day and per month.
http://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-da...

[dhavamanis]

Thanks, i have just added wildcard search for source to get the results.

index=_internal source="*license_usage.log*" type=Usage  | eval yearmonthday=strftime(_time, "%Y%m%d") | eval yearmonth=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024/1024)) AS volume_b by idx yearmonthday yearmonth | chart sum(volume_b) over yearmonth by idx

[indut]

hi, Why do we have 2 fields  yearmonthday  and yearmonth in this query? 

[indut]

hi any update on this from anyone ? Thank you!

[ppablo]

Great, I'm glad it helped you find your solution 🙂