Splunk Search

Splunk search showing ingest by source method


Looking to create a search / report showing the ingest by source ingestion method in the last 24hours. I am looking for the source to be the amount of data in GB being ingested by total source.  So for example, how much data in GB's is being ingested for the following source ingest methods: 


Labels (6)
0 Karma


Firstly, your question is a bit inconsistent since those "methods" are not mutually exclusive. For example, a syslog event can be ingested on a network input on an UF or via SC4S pushed to HEC endpoint.

Secondly, unless explicitly configured, splunk on its own doesn't retain metadata about the transport it got the data from (it can however be reflected to some extent in the source field value).

Thirdly, apart from the metrics which splunk gathers anyway you'd have to scan through all of your events to calculate sum of their lengths which would be highly ineffective (that's why splunk accumulates license usage count as it ingests every single event so it doesn't have to do it retroactively if needed).

So it's not that easy.

What you already have in license usage metrics you already have, what you don't have will be hard to compute.

Ultra Champion

Hi @scout29 ... on your search head, you can go to Settings ---> Monitoring Console ----> "indexing" tab ----> License Usage ---- > today or historical

this will give you today or last week/months license usage conception dashboards. 

Please suggest if thats what you are looking for, thanks. 



Splunk newbie learning videos, for absolute beginners:



0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...