Splunk Search

How to request volume per source per day (time stamped, not indexed) ?

albasii
New Member

Many questions deal with indexed volume per source and per day for licence concern. My need is logs volume per source and per day. To explain more, I want to know the volume of each source without taking into account catching of old logs which could not be indexed in the past. So not the indexed volume per day but the volume of logs time stamped at a given day.

0 Karma

DavidHourani
Super Champion

Hi @albasii,

As you already know the data volume is directly linked to the event count for each sourcetype. An easy way to find volume change per sourcetype and per day is by using this base search :

 | tstats count WHERE index=* by _time,sourcetype

From there you can make a timechart and look for any weird changes in data ingestion.

 | tstats count as total WHERE index=* by _time,sourcetype | timechart sum(total) as total by sourcetype 

Hope this helps!

Cheers,
David

0 Karma

adonio
SplunkTrust
SplunkTrust

you can use the very inefficient ... | eval raw_size = len(_raw) | stats sum(raw_size) as total by source index
how many events you have that are old (over 24 hours) but are indexed "new" (24 hours or more later)?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!