Diagnosing your data usage
It is important to understand what inputs, departments or indexes are using what amount of data so that you can plan accordingly and stay within your daily license limit.
Indexed data by sourcetype
index=*
| fields _raw, _time, sourcetype
| eval evt_bytes = len(_raw)
| timechart span=1d sum(eval(evt_bytes/1024/1024)) AS TotalMB by sourcetype
Index data by source
index=*
| fields _raw, _time, source
| eval evt_bytes = len(_raw)
| timechart span=1d sum(eval(evt_bytes/1024/1024)) AS TotalMB by source
(eval(round(b/1024/1024,4))) AS Total_MB by index_name
Indexed data by index
index=_internal source=*license_usage.log type=Usage
| fields idx, b
| rename idx as index_name
| timechart span=1d limit=20 sum(eval(round(b/1024/1024,4))) AS Total_MB by index_name