https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30432#M178028 <P>When I look under "Manager-&gt;indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.<BR /> But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.</P> <P>Am I reading this incorrectly, or could something else be up?</P> Thu, 09 Aug 2012 13:51:24 GMT reedmohn 2012-08-09T13:51:24Z https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30432#M178028 <P>When I look under "Manager-&gt;indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.<BR /> But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.</P> <P>Am I reading this incorrectly, or could something else be up?</P> Thu, 09 Aug 2012 13:51:24 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30432#M178028 reedmohn 2012-08-09T13:51:24Z https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30433#M178029 <P>For Splunk roles there is a setting for 'Indexes searched by default'. Manager &gt; Access Controls &gt; Roles. I think if you check there, you will see other indexes that are listed by default. Do you see more than just the 'main' index there?</P> Thu, 09 Aug 2012 13:57:58 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30433#M178029 sdaniels 2012-08-09T13:57:58Z https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30434#M178030 <P>No, main the only one listed as default here. But I don't see that this factors in. The two sources mentioned are both stored in the main index. In fact, the largest one alone is 1.7bill according to the summary page...</P> Thu, 09 Aug 2012 14:03:23 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30434#M178030 reedmohn 2012-08-09T14:03:23Z https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30435#M178031 <P>Yep, i have a different set up so it was worth a try. I'm putting my answer in the comments so someone else can answer.</P> Thu, 09 Aug 2012 14:06:12 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30435#M178031 sdaniels 2012-08-09T14:06:12Z https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30436#M178032 <P>Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.</P> <P>So all the "missing" data were on indexer #2.....</P> Fri, 24 Aug 2012 21:23:34 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-actual-number-of-events/m-p/30436#M178032 reedmohn 2012-08-24T21:23:34Z