Internal metrics queries will tell you how much was actually indexed during a particular period. If you indexed several days worth of data in one day, this won't be that useful to you, although of course if you know how many days worth of data you indexed, you can get an average. If over the long term you plan to index data in real time and want to find out how much data is timestamped per day after it has been indexed, you can be fairly close with: * | eval l=len(_raw) | timechart span=1d sum(l) But be warned that this will take a very long time to run depending on the amount of data in your index and the speed of your hardware, and furthermore this level of precision is not any more useful than averages, so metrics queries are preferred if you can possibly use those. ... View more