Splunk search showing ingest by source method

[scout29]

Looking to create a search / report showing the ingest by source ingestion method in the last 24hours. I am looking for the source to be the amount of data in GB being ingested by total source.  So for example, how much data in GB's is being ingested for the following source ingest methods: 

UF's
Syslog
API
HEC
DBX

[PickleRick]

Firstly, your question is a bit inconsistent since those "methods" are not mutually exclusive. For example, a syslog event can be ingested on a network input on an UF or via SC4S pushed to HEC endpoint.

Secondly, unless explicitly configured, splunk on its own doesn't retain metadata about the transport it got the data from (it can however be reflected to some extent in the source field value).

Thirdly, apart from the metrics which splunk gathers anyway you'd have to scan through all of your events to calculate sum of their lengths which would be highly ineffective (that's why splunk accumulates license usage count as it ingests every single event so it doesn't have to do it retroactively if needed).

So it's not that easy.

What you already have in license usage metrics you already have, what you don't have will be hard to compute.

[inventsekar]

Hi @scout29 ... on your search head, you can go to Settings ---> Monitoring Console ----> "indexing" tab ----> License Usage ---- > today or historical

this will give you today or last week/months license usage conception dashboards. 

Please suggest if thats what you are looking for, thanks. 

Splunk newbie learning videos, for absolute beginners:

https://www.youtube.com/@SiemNewbies101/playlists