I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index.
Can any one help me with spl query? and is it possible to get actual .txt file size from splunk?
@codebuilder It will provide count of lines by source but I want how much log size data(in MB/GB) is got indexed per day by specific index vs total license size (MB/GB) utilization per day.
index=_internal sourcetype=splunkd component=LicenseUsage idx=replace_with_your_index_name | timechart span=1d sum(b) as Usage | eval Usage=round(Usage/1024/1024/1024,2)
Also, both the DMC and Master provide nice dashboards for monitoring both.