If syslog is one of the top ten sourcetypes or sources, then you can use the metrics log search below:
index=_internal source=*metrics.log* per_sourcetype_thruput series=syslog | eval gb=kb/1024/1024 | stats sum(gb) as Total
If you want to see a charted breakdown, you can substitute the timechart command for stats:
... | timechart span=1d sum(gb) as Total | addtotals
For the above searches, use the TimeRange picker to select the 30, 60, or 90 day duration. If syslog is not in the top ten sourcetypes, you'll have to do a somewhat expensive query that measures the raw size of the events. So something like:
sourcetype=syslog | eval size=len(_raw) | stats sum(size)
... View more
