How to calculate splunk data size injected per day or time based on forwarders

[vradhakrishnan]

I have multiple forwarders sending data into splunk index and I want to find size of each host sending data into splunk by forwarder.
Is there any way to calculate this.

[woodcock · Accepted solution]

It is unclear but maybe you can get what you need from the Data Summary:

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchTutorial/Aboutthesearchapp#Data_summary

Other than that you can run a search like this:

index=* OR index=_* | eval bytes=len(_raw) | stats sum(bytes) values(sourcetype) by host

[CryoHydra]

| stats sum(len) ? or sum(bytes)

[woodcock]

Another typo. Fixed.

[ConnorG]

What's the purpose of "index=* AND index=_*" ?

[woodcock]

My bad, it should be OR, not AND. I fixed it.

[vradhakrishnan]

woodcock you query is what I was look for thanks for your help.