how to calculate the data received per day?

[pacifikn]

Greetings!!

Dear all!

Hope you are well.

I need your support on how to calculate the size of events we received per day, for instance, if you want to check the size of each data we have received in one week?

I am using Splunk enterprise (Linux server)

Thank you in advance!

[pacifikn]

help me also on How to calculate the percentage of Daily license used? I mean per day?

[aasabatini · Accepted solution]

Hi @pacifikn 

try this search 

index=_internal source=*license_usage.log | eval GB=b/1024/1024/1024 | stats sum(GB) by h | sort -sum(GB)

[pacifikn]

Thank you so much @aasabatini  for your prompt response,

This works well for each source, Is there anyhow you could also calculate the total size of all sources we have received?

[aasabatini]

Hi @pacifikn 

index=_internal source=*license_usage.log  | eval GB=b/1024/1024/1024 | stats sum(GB) as volume_in_GB by idx s st | sort - volume_in_GB 
| rename idx AS index s AS source st AS sourcetype

if this search help karma point is appreciated

Alessandro