I'm trying to write a query to track the amount of data being ingested to a specific index, measure in MB/per minute.
This is what I have so far:
index=my_index_name metrics name=index_thruput sourcetype=splunkd | timechart span=1m sum(eval(kb/1024)) as "MB/min"
↧