I plan to calculate the traffic volume in GB across all our HFs. Need this to ensure check which HF is getting max traffic as this is affecting. I was able to get memory, cpu and bandwidth utilization from index= _interospection and index=_internal
index=_internal host IN ("yourheavyforwarders") group=per_index_thruput | stats sum(kb) as kb by host | eval GB=round(kb/1024/1024,2) | fields - kb
Note: if you want to exclude internal indexes which are starting with _(underscore), you can use below search
index=_internal host IN ("yourheavyforwarders") group=per_index_thruput series!=_* | stats sum(kb) as kb by host | eval GB=round(kb/1024/1024,2) | fields - kb
If you are looking for total volume sent (including _internal) and not just license usage here is a good search:
index=_internal sourcetype=splunkd group=tcpin_connections (connectionType=cooked OR connectionType=cookedSSL) fwdType=* guid=* | eval dest_uri = host.":".destPort | stats values(fwdType) as forwarder_type, latest(version) as version, values(arch) as arch, dc(dest_uri) as dest_count, values(os) as os, max(_time) as last_connected, sum(kb) as new_sum_kb, sparkline(avg(tcp_KBps), 1m) as avg_tcp_kbps_sparkline, avg(tcp_KBps) as avg_tcp_kbps, avg(tcp_eps) as avg_tcp_eps by guid, hostname | eval hostname = upper(hostname)
This provides quite a bit of extra info. You can convert kb to GB as needed.
see Splunk Distributed Monitoring Console App and you can find your searches.
do you mean license usage? e.g. raw data received by indexers through Heavy Forwarders?