topic Re: Can you create this query please? in Splunk Search

Can you create this query please?

test2001 — Fri, 03 Jun 2022 18:12:05 GMT

Can you create a query that search for all the logs that got entered in an index for the last 24hours and group it by index? That similar to a table with the number of logs added per index in the period of time you select.

It would be much appreciated thank you so much for your help:)

Re: Can you create this query please?

hackalope — Fri, 03 Jun 2022 19:22:19 GMT

This question has a lot of discussion that's similar to your problem. From that, I think the following query will do what you want.

| tstats count values(sourcetype) WHERE index=* BY index

Don't forget about the metadata command - that's another good one to see the latest event received by sourcetype and other ingest monitoring information.

Re: Can you create this query please?

somesoni2 — Fri, 03 Jun 2022 19:29:43 GMT

Try like this (Select appropriate timerange)

| tstats count WHERE index=* by index

Re: Can you create this query please?

test2001 — Wed, 08 Jun 2022 15:07:12 GMT

Perfect this helps thank you so much!

Re: Can you create this query please?

test2001 — Wed, 08 Jun 2022 15:07:33 GMT

Perfect I will check it out and thank you for your answer!