This should do it - this shows how much data has been indexed from various hosts
index=_internal source=*metrics.log group="tcpin_connections"
| eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| stats sum(kb) as KB by sourceHost | eval KB = round(KB)
This should do it - this shows how much data has been indexed from various hosts
index=_internal source=*metrics.log group="tcpin_connections"
| eval sourceHost=if(isnull(hostname), sourceHost,hostname)
| stats sum(kb) as KB by sourceHost | eval KB = round(KB)