https://community.splunk.com/t5/Splunk-Search/Which-is-this-the-best-way-to-get-a-count-of-events-indexed-for/m-p/432114#M173295 <BLOCKQUOTE> <P>Blockquote<BR /> 1.<BR /> | eventcount summarize=false | stats sum(count)</P> <P>Blockquote</P> </BLOCKQUOTE> <P>OR</P> <BLOCKQUOTE> <P>Blockquote<BR /> 2. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Aboutmetricslog">https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Aboutmetricslog</A></P> </BLOCKQUOTE> <P>index=_internal source=*metrics.log group=thruput | stats sum(ev)</P> <BLOCKQUOTE> <P>Blockquote</P> </BLOCKQUOTE> <P>My use case is currently for last 30 days, and I am getting <EM>very</EM> different results. The first search command appears to be identical to the dashboard that shows up on the "What to Search" section on the search and reporting home page.</P> <P>The metrics.log I want to believe to be more accurate given that I can't do a time modifier on the first search command, "| eventcount." </P> Tue, 29 Jan 2019 21:03:34 GMT bgagliardi1 2019-01-29T21:03:34Z https://community.splunk.com/t5/Splunk-Search/Which-is-this-the-best-way-to-get-a-count-of-events-indexed-for/m-p/432114#M173295 <BLOCKQUOTE> <P>Blockquote<BR /> 1.<BR /> | eventcount summarize=false | stats sum(count)</P> <P>Blockquote</P> </BLOCKQUOTE> <P>OR</P> <BLOCKQUOTE> <P>Blockquote<BR /> 2. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Aboutmetricslog">https://docs.splunk.com/Documentation/Splunk/7.2.3/Troubleshooting/Aboutmetricslog</A></P> </BLOCKQUOTE> <P>index=_internal source=*metrics.log group=thruput | stats sum(ev)</P> <BLOCKQUOTE> <P>Blockquote</P> </BLOCKQUOTE> <P>My use case is currently for last 30 days, and I am getting <EM>very</EM> different results. The first search command appears to be identical to the dashboard that shows up on the "What to Search" section on the search and reporting home page.</P> <P>The metrics.log I want to believe to be more accurate given that I can't do a time modifier on the first search command, "| eventcount." </P> Tue, 29 Jan 2019 21:03:34 GMT https://community.splunk.com/t5/Splunk-Search/Which-is-this-the-best-way-to-get-a-count-of-events-indexed-for/m-p/432114#M173295 bgagliardi1 2019-01-29T21:03:34Z https://community.splunk.com/t5/Splunk-Search/Which-is-this-the-best-way-to-get-a-count-of-events-indexed-for/m-p/432115#M173296 <P>Hello @bgagliardi1 </P> <P>What about this:</P> <PRE><CODE>| tstats count WHERE index=* </CODE></PRE> Wed, 30 Jan 2019 06:51:16 GMT https://community.splunk.com/t5/Splunk-Search/Which-is-this-the-best-way-to-get-a-count-of-events-indexed-for/m-p/432115#M173296 vishaltaneja070 2019-01-30T06:51:16Z