How to get ingest volume for 1200 sourcetypes ?

[sverdhan]

 i have a query that will calculate the volume of data ingested in a sourcetype--

index=federated:infosec_apg_share source=InternalLicenseUsage type=Usage idx=*_p* idx!=zscaler* st=<your sourcetype here> | stats sum(b)  | eval GB = round('sum(b)'/1073741824,2) | fields GB

The issue is  I have a list of 1200 sourcetypes . please suggest me how can I adjust the entire list into this query 

[Jawahir]

I hope this search query proves useful to you.

index=federated:infosec_apg_share source=InternalLicenseUsage 
type=Usage idx=*_p* idx!=zscaler* st IN ([ search index=<your_index> 
| stats count by sourcetype | fields sourcetype ])
| stats sum(b) by st | eval GB = round('sum(b)'/1073741824,2) 
| fields st, GB

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

[gcusello]

Hi @sverdhan ,

if you have more than 1200 sourcetypes probably there's an error in your system design because 1200 sourcetypes aren't manageable, and my hint is to analyze and redesign your data structure!

Anyway, if you want a table with the volume of all the sourcetypes the only way is to filter your search selecting sourcetypes in an input to have only a subset of your sourcetypes.

Otherwise, is there a rule to group your sourcetypes (e.g. part of the name, or source or index)?

Ciao.

Giuseppe