log file size Vs license size per day by specific index

[ips_mandar]

Hi,
I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index.
Can any one help me with spl query? and is it possible to get actual .txt file size from splunk?
Thanks,

[ips_mandar]

hey splunkers, is there any way by which I can calculate splunk indexed actual log file size per day?
thanks,

[codebuilder]

Yes, run the following search to get the info you are looking for:

|tstats count where index=* by source

Or replace "index=*" with the name of the index you are interested in.

[ips_mandar]

@codebuilder It will provide count of lines by source but I want how much log size data(in MB/GB) is got indexed per day by specific index vs total license size (MB/GB) utilization per day.

[codebuilder]

Try this:

index=_internal sourcetype=splunkd component=LicenseUsage idx=replace_with_your_index_name
| timechart span=1d sum(b) as Usage | eval Usage=round(Usage/1024/1024/1024,2)

Also, both the DMC and Master provide nice dashboards for monitoring both.

[ips_mandar]

@codebuilder, Thanks but above query will provide license usage and I also want actual log file size which splunk has indexed per day. is it possible?