i am searching for a CLI Search Command which gives me the result of the daily Indexed volume per Host.
Which is the same as i do it via the GUI / Browser -->
Splunk --> Status --> Index activity --> Indexing Volume --> Split by Host / Yesterday
I found it!!!
Thank you very much.
/opt/splunk/bin/splunk search "index=internal source=*licenseusage.log type=Usage earliest=-1d@d latest=-0d@d | eval MB=b/1024/1034 | stats sum(MB) by h | sort sum(MB) | reverse" -auth test:test123
View solution in original post