How to request volume per source per day (time stamped, not indexed) ?

[albasii]

Many questions deal with indexed volume per source and per day for licence concern. My need is logs volume per source and per day. To explain more, I want to know the volume of each source without taking into account catching of old logs which could not be indexed in the past. So not the indexed volume per day but the volume of logs time stamped at a given day.

[DavidHourani]

Hi @albasii,

As you already know the data volume is directly linked to the event count for each sourcetype. An easy way to find volume change per sourcetype and per day is by using this base search :

 | tstats count WHERE index=* by _time,sourcetype

From there you can make a timechart and look for any weird changes in data ingestion.

 | tstats count as total WHERE index=* by _time,sourcetype | timechart sum(total) as total by sourcetype 

Hope this helps!

Cheers,
David

[adonio]

you can use the very inefficient ... | eval raw_size = len(_raw) | stats sum(raw_size) as total by source index
how many events you have that are old (over 24 hours) but are indexed "new" (24 hours or more later)?