Splunk Search

Splunk search showing ingest by source method

scout29
Path Finder

Looking to create a search / report showing the ingest by source ingestion method in the last 24hours. I am looking for the source to be the amount of data in GB being ingested by total source.  So for example, how much data in GB's is being ingested for the following source ingest methods: 

UF's
Syslog
API
HEC
DBX

Labels (6)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, your question is a bit inconsistent since those "methods" are not mutually exclusive. For example, a syslog event can be ingested on a network input on an UF or via SC4S pushed to HEC endpoint.

Secondly, unless explicitly configured, splunk on its own doesn't retain metadata about the transport it got the data from (it can however be reflected to some extent in the source field value).

Thirdly, apart from the metrics which splunk gathers anyway you'd have to scan through all of your events to calculate sum of their lengths which would be highly ineffective (that's why splunk accumulates license usage count as it ingests every single event so it doesn't have to do it retroactively if needed).

So it's not that easy.

What you already have in license usage metrics you already have, what you don't have will be hard to compute.

inventsekar
SplunkTrust
SplunkTrust

Hi @scout29 ... on your search head, you can go to Settings ---> Monitoring Console ----> "indexing" tab ----> License Usage ---- > today or historical

this will give you today or last week/months license usage conception dashboards. 

Please suggest if thats what you are looking for, thanks. 

 

 

Splunk newbie learning videos, for absolute beginners:

https://www.youtube.com/@SiemNewbies101/playlists

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...