topic Re: Global summary - Events Indexed counter in Knowledge Management

Global summary - Events Indexed counter

gekoner — Thu, 19 May 2011 23:30:50 GMT

If the Events Indexed in the Global summary on the main summary page, if this number decreases, does that mean an index was deleted? What other reason would there be for a decrease in this number?

Re: Global summary - Events Indexed counter

bwooden — Fri, 20 May 2011 17:11:54 GMT

That field is populated by summing the counts of events for each sourcetype as found in the metadata.

This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.

Re: Global summary - Events Indexed counter

gekoner — Fri, 20 May 2011 18:03:51 GMT

Thanks bwooden, looks like the maxTotalDataSizeMB was set and some data rolled over to frozen.

Re: Global summary - Events Indexed counter

dwaddle — Fri, 20 May 2011 19:02:06 GMT

Most likely, this is because a Splunk index bucket was rolled from cold to frozen (and possibly deleted, depending on your configuration). As buckets age, they move from hot to warm to cold to frozen. The default action for moving to frozen is to delete the bucket. Your "events indexed" counter would then be reduced by the number of events in that bucket.

The docs cover this well at http://www.splunk.com/base/Documentation/4.2.1/Admin/HowSplunkstoresindexes