all,
Is there a better way to get data by indexer than this search from the search head withouth access to the internal indexes/
index=*
| fields _raw, volume, splunk_server
| eval volume=len(_raw)
| stats sum(volume) by splunk_server
↧