How much data in MB/GB is ingested by a single sourcetype from defined host/clientname
Try this
index=_internal sourcetype=splunkd source=*license_usage.log type=Usage h=YourHostNameHere st=YourSourceTypeHere
| stats sum(b) as usage by h st | eval usageMB=roung(usage/1024/1024,3)
Not getting serverlist in prod...
Do want to mention a typo in the provided SPL.
It should be:
index=_internal sourcetype=splunkd source=*license_usage.log type=Usage h=YourHostNameHere st=YourSourceTypeHere
| stats sum(b) as usage by h st | eval usageMB=round(usage/1024/1024,3)