How to find top 5 input data volumes of the day?

[Alan_Bradley]

I got Your index exceeded your 20.00 GB/day limit again. I would like to know which data inputs cause this.

[BunnyHop]

I would recommend downloading the Splunk License Usage app available from the SplunkBase repository.

http://www.splunkbase.com/apps/All/4.x/App/app:Splunk+License+Usage

[matt · Accepted solution]

This search should give you the answer

index=_internal Metrics "group=per_source_thruput" NOT series="/Applications/splunk34/splunk/var/log/splunk/license_audit.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/metrics.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/searchhistory.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunkd.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/splunklogger.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_access.log" NOT series="/Applications/splunk34/splunk/var/log/splunk/web_service.log" NOT series="filetracker" NOT series="audittrail" NOT series="fschangemonitor" | timechart span=1d sum(kb) by series