Splunk query to get top sorcetypename=kubernetes_logs, devided by services (or namespaces)

[alekseisaiko]

Hi there!
I need a query, that will show me Top Sourcetype Sizes by Day, where sourcetype=kubernetes_logs, and the kubernetes_logs itself, to divide by service names (or namespace names).
RIght now, I'm using this query -

index=_internal source=*license_usage.log type="Usage"
| eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| eval sourcetypename = st
| bin _time span=1d
| stats sum(b) as b by _time, pool, indexname, sourcetypename
| eval GB=round(b/1024/1024/1024, 3)
| fields _time, indexname, sourcetypename, GB
| sort by GB
| reverse

But how do I exclude only kubernetes_logs from here, and divide it by service names?

Thanks!

[alekseisaiko · Accepted solution]

Solved it

[alekseisaiko]

Or maybe source must be used instead of sourcetypename? For example “kube:container"? But still I have no success to pull the container logs

[to4kawa]

sample of results please.