Splunk Search

How to check log volume indexed per day in a particular index

asharma21193
New Member

I want to calculate the total volume of logs index per day for a particular index. is there any search query for the same ?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this query:

index=_internal source=*metrics.log group=per_index_thruput series=<a particular index>
| eval GB=kb/1024/1024 | timechart span=1d sum(GB) as GB | eval GB=round(GB,2)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

woodcock
Esteemed Legend

Try Meta Woot! app. It breaks down license usage even to the host level.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this query:

index=_internal source=*metrics.log group=per_index_thruput series=<a particular index>
| eval GB=kb/1024/1024 | timechart span=1d sum(GB) as GB | eval GB=round(GB,2)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...