Can you use tstats to get daily index or indexer volume?

[Glasses]

Just wondering if its possible to get data volume / size from TSTATS.

I know you can do something like this to get counts (events/per sec)

| tstats count WHERE index=* by index| eval events_per_second=count/(3600*24)

but how can you use tstats for find volume of data per time?

[richgalloway · Accepted solution]

As far as I can tell, there is no indexed field that indicates data volume so you can't use tstats to get that value.

[Glasses]

thank you for confirming, I could not find a list of tstats fields.... is there a doc for tstat fields?

[richgalloway]

There is no documentation for tstats fields because the list of fields is not fixed. It depends on which fields you choose to extract at index time. You can, however, use the walklex command to find such a list.

walklex type=term index=foo