Hi @PickleRick ; I have used dbinspect command but here I need sourcetype and even the total count and size of command_type="METER_ALERT" and NON "METER_ALERT" separately . Query : index=service_audit sourcetype=SMWAN command_type !="METER_ALERT" |eval size=len(_raw) | eval raw_len_KB= size/1024 | eval raw_len_MB = size/1024/1024 | eval raw_len_GB = size/1024/1024/1024 | table size,raw_len_KB,raw_len_MB ,raw_len_GB,index | stats count sum(size) as Bytes sum(raw_len_KB) as KB sum(raw_len_MB) as MB sum(raw_len_GB) as GB by index
... View more