Splunk Search

How to find top 5 input data volumes of the day?

Path Finder

I got Your index exceeded your 20.00 GB/day limit again. I would like to know which data inputs cause this.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

This search should give you the answer

index=_internal Metrics "group=per_source_thruput" NOT series="/Applications/splunk34/splunk/var/log/splunk/license_audit.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/metrics.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/searchhistory.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunkd.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunklogger.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_access.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_service.log" NOT series="filetracker" NOT series="audittrail" NOT series="fschangemonitor" | timechart span=1d sum(kb) by series

View solution in original post

Contributor

I would recommend downloading the Splunk License Usage app available from the SplunkBase repository.

http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

Splunk Employee
Splunk Employee

This search should give you the answer

index=_internal Metrics "group=per_source_thruput" NOT series="/Applications/splunk34/splunk/var/log/splunk/license_audit.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/metrics.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/searchhistory.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunkd.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunklogger.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_access.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_service.log" NOT series="filetracker" NOT series="audittrail" NOT series="fschangemonitor" | timechart span=1d sum(kb) by series

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!