total amount of data logged per host or source or sourcetype

[Sid]

Hi Team,

I have containerized sc4s hosts which have ufs installed  but sc4s is forwarding data via HEC, i want to see the total logging size per host or sc4s source, can someone help me with the query to get that data .

[PickleRick]

Check the searches from the license report and adjust to your needs.

[Sid]

@PickleRick  we have cloud deployment and i see only two panels in ingest , i want data by per sc4s host not splunk server. 

[PickleRick]

OK. Cloud can be different here. My way works in an on-prem environment.