From my prospective , i believe the indexing speed by source, sourcetype, host, or index can be calculated using the below SPL or the search query.
index="_internal" source="*metrics.log" per_source_thruput series=ps | eval MB=kb/1024 | timechart span=5m sum(MB) by series
probably your search is correct, even if i don't exactly understand what't your Use Case, what's series?
and generally, why invent hot water?
in the Monitorinbg Console you have all the searches to calculate all the needed metrics (indexing speed, license consuption, etc...).
I'd prefer a standard solution, but you could also use your search.
Tell me if I can help you more.
Ciao and happy splunking.
P.,S.: Karma Points are appreciated 😉
using the Monitoring Console, you have all the information about data logs tranferred from each UF to Indexers.
[Settings -- Monitoring Console -- Forwarders]
If you don't have, you have to configure Monitoring Console to monitor UFs in [Settings -- Monitoring Console -- Settings -- Forwarders Monitoring Setup].
in the Monitoring Console, you have the traffic for each client sending logs.
If you want to knopw the weight of each file, you should count the chars of earch source.
You can find documentation about Monitoring Console at https://docs.splunk.com/Documentation/Splunk/8.2.4/DMC/DMCoverview