Depending on what version you are running there may be a few places to look. That said the easiest and best place is probably the Monitoring Console, see link below for docs. If you want to run searches you can, see below for one example. There are a lot of answers already existing for ways to do that. There are quite a few different ways to get to the same data. DMC - https://docs.splunk.com/Documentation/Splunk/6.5.1/DMC/DMCoverview Search - https://answers.splunk.com/answers/154773/how-to-create-a-report-that-shows-max-indexed-volume-per-day-by-month-per-index.html ... View more

Are you looking for best practices regarding the REST API input or searching all time data? ... View more

Ah true, my apologies. From what I am gathering it's kind of a limitation of the sparkline, the fact that you cannot set the span of the entire sparkline. That is controlled by the stats and chart commands tied to it so that might be an option but seems a bit tricky and would most likely skew results. I haven't found a way to specifically rewrite your search to get the desired results though I have a few other ideas that might work. If you aren't married to using sparklines you might be able to use timechart to overlay the results in a line graph or something similar? ... View more

Your sparkline is actually limited to a 2 hour span in both searches: sparkline(sum(count),2h) Have you tried adjusting that? Or just removing the span? I believe it defaults to 24 hours. ... View more