Splunk Search

How to calculate the size of the source type?

lamnguyentt1
Explorer

Dear professional,

I run my search string bellow

index="hcg_oapi_prod" source="/var/log/app/rest.log"

 And this is my result that is illustrated in the figure.

I have about 13 source types, ex: "oapi:atl-customer:rest", etc.

lamnguyentt1_0-1645436722091.png

Please help me to get the size of each source type. I can only get the size of index like this

lamnguyentt1_1-1645436881104.png

Thank you.

 

 

Labels (2)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @lamnguyentt1,

Found the same question while exploring community answers and here's your solution - https://community.splunk.com/t5/Getting-Data-In/How-do-you-calculate-the-size-of-indexed-data-as-per... 

index=_internal source=*license_usage.log*  type=Usage idx=<yourindexname> | eval GB=b/1024/1024/1024 | stats sum(GB) by st
---
If you find the answer helpful, an upvote/karma is appreciated
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...