Splunk Search

How to check log volume indexed per day in a particular index

asharma21193
New Member

I want to calculate the total volume of logs index per day for a particular index. is there any search query for the same ?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this query:

index=_internal source=*metrics.log group=per_index_thruput series=<a particular index>
| eval GB=kb/1024/1024 | timechart span=1d sum(GB) as GB | eval GB=round(GB,2)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

woodcock
Esteemed Legend

Try Meta Woot! app. It breaks down license usage even to the host level.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this query:

index=_internal source=*metrics.log group=per_index_thruput series=<a particular index>
| eval GB=kb/1024/1024 | timechart span=1d sum(GB) as GB | eval GB=round(GB,2)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...