Search for the volume of data ingested into a specific index in MB

[rleadingham]

I have spent hours today researching and testing all sort of searches and I just cannot figure out how to find the information I want. I would have thought it would have been straight forward to find the total volume of data sent to a specific index in MB.

I have came close but only by experimenting with many examples I found on the site.

Any advice would be very much appreciated.

Thank you!

[woodcock]

Setup a Monitoring Console:

https://docs.splunk.com/Documentation/Splunk/6.6.1/DMC/DMCoverview

[somesoni2 · Accepted solution]

Try this (gives the amount of license used for indexes)

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
| stats sum(b) as bytes by idx | eval mb=round(bytes/1024/1024,3)

[splunkdevabhi]

How to check the daily indexing in such cases ? Would adding span=1d and a timechart help?

[somesoni2]

If you want overall, then you can use this timechart version

index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
 | timechart span=1d sum(b) as usage_mb| eval usage_mb=round(usage_mb/1024/1024,3)

For per index, you can use this

  index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
     | timechart span=1d sum(b) as usage by idx limit=0 | foreach * [ eval "<<FIELD>>"=round('<<FIELD>>'/1024/1024,3)]

OR

 index=_internal sourcetype=splunkd source=*license_usage.log type=Usage 
     | bucket span=1d _time | stats sum(b) as bytes by _time idx | eval mb=round(bytes/1024/1024,3)

[rleadingham]

This is absolutely perfect thank you very much. I have what I am looking for and I have learnt more about how to query in Splunk!