How to calculate the size of the source type?

[lamnguyentt1]

Dear professional,

I run my search string bellow

index="hcg_oapi_prod" source="/var/log/app/rest.log"

 And this is my result that is illustrated in the figure.

I have about 13 source types, ex: "oapi:atl-customer:rest", etc.

Please help me to get the size of each source type. I can only get the size of index like this

Thank you.

[tshah-splunk]

Hey @lamnguyentt1,

Found the same question while exploring community answers and here's your solution - https://community.splunk.com/t5/Getting-Data-In/How-do-you-calculate-the-size-of-indexed-data-as-per... 

index=_internal source=*license_usage.log*  type=Usage idx=<yourindexname> | eval GB=b/1024/1024/1024 | stats sum(GB) by st