data ingest size from a server

[jiaqya]

how to identify data ingest size from a server per day...

looking to find sizes of data ingested from each server for planning ..

[adonio · Accepted solution]

this is one way:

earliest=-1d@d latest=@d  index=_internal source=*license_usage.log* type=Usage
| stats sum(b) AS Bytes by h
| eval GB = Bytes/1024/1024/1024
| table h GB
| sort -GB

explore the data h stands for host
there are many many ways to get this data and quick search in this portal will prompt you to dozens of results
hope it helps

[jiaqya]

Adonio, thanks for your reply, unfortunately the query you gave returned 0 records.
i tried running this on the forwarder where i am inserting data via file inputs.

also i could not find any other document which can give me a ingest rate ..

[jiaqya]

thanks, running it on search head gave me the result.

[adonio]

are you an admin? or do you have admin role?
you are supposed to run queries on the Search Head

[SamHTexas]

Sir, how would I calculate he total amount of ingestion into an average server if only logs & small / Med DBs are ingested into the Splunk server? Thanks a million in advance.