How do I find out which hosts are pushing the most data to our Splunk Cloud account? Volume usage showing a spike.

[clearslide_cwon]

Not sure how I can find out which host(s) that are pushing the most data/logs to our Splunk Cloud account. It's reaching our limit.
Unfortunately, the Volume Usage tab isn't very detailed.

[sundareshr]

Try this

index=_internal source=*license_usage.log* type=Usage | timechart span=1h sum(b) AS vol by h

[rsolutions]

You could always just search the raw logs (may take a while if you have a lot of data)... index=* earliest=-7d@d latest=@d | eval size=len(_raw)/1024/1024 | timechart sum(size) by host

[rsolutions]

This looks good as a line or area chart... you can easily see what host has has a significant increase. If you find the host... add it to the base search and the edit the timechart to be by sourcetype. This should help you zero in on what has caused the recent increase in logging.