Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Ingested Comments Copy


				 [ | tstats count where punct=#* by index, sourcetype | fields - count | format ] _raw=#*

0 comments

[0]

Splunk Search for Volume of Ingested Comments Copy


				[ | tstats count where punct=#* by index, sourcetype | fields - count | format ] _raw=#* 
| eval gb=len(_raw)/pow(1024,3)
| timechart span=1d sum(gb)

0 comments

[0]