Getting Data In

Index volume by host

Explorer

Hello,
i am searching for a CLI Search Command which gives me the result of the daily Indexed volume per Host.

Which is the same as i do it via the GUI / Browser -->
Splunk --> Status --> Index activity --> Indexing Volume --> Split by Host / Yesterday

THX J.

Tags (1)
1 Solution

Explorer

I found it!!!

Thank you very much.

/opt/splunk/bin/splunk search "index=internal source=*licenseusage.log type=Usage earliest=-1d@d latest=-0d@d | eval MB=b/1024/1034 | stats sum(MB) by h | sort sum(MB) | reverse" -auth test:test123

View solution in original post

0 Karma