I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index.
Can any one help me with spl query? and is it possible to get actual .txt file size from splunk?
Yes, run the following search to get the info you are looking for:
|tstats count where index=* by source
Or replace "index=*" with the name of the index you are interested in.
@codebuilder It will provide count of lines by source but I want how much log size data(in MB/GB) is got indexed per day by specific index vs total license size (MB/GB) utilization per day.
index=_internal sourcetype=splunkd component=LicenseUsage idx=replace_with_your_index_name | timechart span=1d sum(b) as Usage | eval Usage=round(Usage/1024/1024/1024,2)
Also, both the DMC and Master provide nice dashboards for monitoring both.