You can find that search here:
http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume
Counting event sizes over a time range
Roughly, you can run a search where you look at all (or some) data over a range of indexed_time values, counting up the size of the actual events.
For example, where the endpoints START_TIME and END_TIME are numbers in seconds from the start of unix epoch, the search would be
indexed_time>START_TIME indexed_time<END_TIME |eval event_size=len(_raw) | stats sum(event_size)
This is a slow and expensive search, but when you really need to know, can be valuable. It must be run across a time range that can contain all possible events that were indexed at that time -- meaning regardless of timestamp regularity. Typically this means it must be run over all time. The stats computationg as well as initial filters can of course be adjusted to look at the problem more closely.
... View more
