Getting Data In

How to search data usage by sourcetype

anil1432
Explorer

Hello everyone, 

 

I need  query to find out 

sourcetype =gshshsh

is using how much of data  

1. From February month day wise usage.  and

2. From September to February month data  usage

Labels (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hi @anil1432,

I couldn't understand much of what do you mean by data usage?

If this is in the context of license usage based on sourcetype, you can navigate to Monitoring Console -> Indexing -> License Usage -> License Usage - Previous 30 days dashboard and filter the data to display the dashboard split by "sourcetype". And since it is based on timechart, you can find the usage for different periods of time as per your need. 

 

If this is in the context of event count based on sourcetype, you can run the following search query between specific time intervals to get the count of events for that specific sourcetype for the defined time interval

| metadata type=sourcetypes index=* splunk_server_group=dmc_group_indexer splunk_server_group="*"
| fields sourcetype, totalCount
| sort - totalCount
| search sourcetype=gshshsh
| rename sourcetype as Sourcetype, totalCount as "Event Count" 
---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...