How to determine daily volume usage in GB for single host

[OMohi]

I would like to know whether there is a query to determine log volume usage for a single host in splunk

[kristian_kolb]

Yes.

The question is how you define host, but if you have a forwarder on the machine in question, and the app SplunkDeploymentMonitor installed on your indexer/search head, you can see the daily log volumes quite easily by clicking around.

You could always fall back on;

host=XYZ | eval size = len(_raw) | timechart span=1d sum(size) by host

run this over 'previous week' or something like that. NB, depending on the amount of events, this may take time.

/K