The question is about source so unfortunately in most environments the usage.log will not be accurate. If you have a small Splunk environment it will probably work, but Splunk squashes the values of source and host to keep the event counts down for the usage.log file. It doesn't squash index or sourcetype so those would be accurate but if you are trying to use host or source and you have an environment that is not small, most likely this will be less accurate than summing up the lengths of all the _raw data. ... View more

You can use clean eventdata to clean the index completely if needed. ... View more

This is the correct answer, worked for me. Thanks for explaining about using OR as well. ... View more