is it possible to see which metrics are causing high data volume send per client? Under Licesing/Volume I can see the MB sum of each Client and a sum of each metric for the whole environment. but not detailed for each client.
The information you are looking for is not part of uberAgent's default dashboards.
Would you please run the following Splunk search? Hopefully, this custom search meets your requirements.
idx=`uberAgent_index` idx!=uberagent_log idx!=ua_meta*
| lookup lookup_uA_sourcetypes_metrics Sourcetype as st OUTPUTNEW uAMetric as "uberAgent metric" uAProduct as "uberAgent product"
sum(b) as SumBytes
by h "uberAgent metric" "uberAgent product"
| eventstats sum(SumBytes) as TotalBytes
| eval "Data volume (MB)" = round (SumBytes / 1048576, 2)
| eval "Data volume (%)" = round (SumBytes / TotalBytes * 100, 2)
| rename h as Host
| sort - "Data volume (MB)"
"Data volume (MB)"
"Data volume (%)"