Just trying to get a swag of cost by sourcetype. I wrote this search, but seems to me there is a more cost effective way to do this.
index=* sourcetype=*NOT sourcetype=stashNOT index=stash| fields _raw| eval bytes=len(_raw)/1024/1024/1024| eval splunk_cost = 685| eval gigcost = bytes * splunk_cost| stats sum(gigcost) as CostPerYear by sourcetype| sort - CostPerYear| addcoltotals
Have a look at some of these
You can also look at tstats, metadata and eventcount commands, which will definitely run faster than the search you are doing
Hi @daniel333 ...so this case depends on your own log, not a generic one like apache logs/win basic logs, etc..
if its a generic log, others would have had this issue and they can give suggestions.
May i know if this use-case is to understand that which sourcetype consumed how much splunk license cost?
if yes, maybe other users also have had this issue and they can give some suggestions.
(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")