How to find how much data is flowing through a particular HEC token in Splunk?

[Hemnaath]

Hi All,   Can any one guide me how to find, how much data is getting ingested into Splunk from a particular HEC token and how much volume of data a single HEC token handle? 

Reason: Currently we are using single token to ingest multiple API data in to splunk and recently our clients wanted to ingest another API data into Splunk,  instead of creating a new token we are planning to use the same token for API data ingestion but before using the same token, we wanted to assess the current data  ingestion by the HEC, to avoid data loss. 

Need a query to fetch the avg data volume consumed by the HEC token per day.

[Hemnaath]

thanks maciep,  for your effort on this, using the below query I was able to achieve the size of data.

in our case particular token was sending data to a particular index/sourcetype, so I used below query to calculate  the size 

index= "index name" | eval size=len(_raw) | eval gbsize=(size/1024/1024/1024) | timcechart span=1d sum(gbsize) 

OR 

index=_internal idx= "index name"  | timechart span=1d eval(sum(b)/(1024*1024*1024)) as GB by idx 

To get the size of the data ingested through particular HEC token.

index="_introspection" source="hhtp_event_collector_metrics" "data.token_name"="token name" | rename "data.total_bytes_indexed as b | timechart span=1d eval (sum(b)/(1024*1024*1024)) as GB by  "data.token_name"

[maciep]

it's been a while since I had access to this data (so I can't put a search together for you), but I believe the _introspection index is where you may want to start.  Maybe this other post will be helpful:  What is included in HEC introspection data? 

[gjanders]

In alerts for splunk admins I have a hec dashboard that might help...
https://splunkbase.splunk.com/app/3796/