How can we find out volume of logs queried in Splunk?

[kml_uvce]

How can we find out volume of logs queried in Splunk

[richgalloway]

What volume do you seek?  Data read from disk, data returned to the SH, data returned to the user, or something else?  AFAIK, there's no good way to measure any of those aside from what's in the dispatch directory and search log (neither of which is indexed).

What problem are you trying to solve?

[kml_uvce]

I am looking for data returned to the SH and data returned to the user,I want to know that how much data is queried(not total but unique) vs how much data is not used or not queried by any user or scheduled search.

[richgalloway]

Yeah, I'm pretty sure that information is not readily available.

I'm still wondering what problem you're trying to solve.  If you want to reduce the data you ingest to match what users search for then knowing the volume won't help.