How to find which sourcetype is sending the highest logs in last 10 minutes

[pankajupadhyay]

Hi,

can someone please help ?

How to get the count or logs in gb/mb from particular sourcetype  on indexer?

[inventsekar]

index=_internal source=*license_usage.log type="Usage" 
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d 
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB

Once you got the results, you can sort / filter them hourly, daily, weekly, etc. 

https://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume

this page got license usage splunk search queries.