topic Re: Search result count in Splunk Search

Search result count

alexspunkshell — Mon, 01 Apr 2024 07:28:03 GMT

I have 10 indexes starts with "ep_winevt_ms" . So i am using * here "index=ep_winevt_ms*".

But while taking the | stats count i want only 1 count for the entire "ep_winevt_ms*". I don't want 10 count for "ep_winevt_ms*". Please help

ITWhisperer — Mon, 01 Apr 2024 07:32:03 GMT

| stats count will give you the count of events returned by the search of all the ep_winevt_ms* indexes.

Why do you think this is not the case?

alexspunkshell — Mon, 01 Apr 2024 07:35:01 GMT

ep_winevt_ms* - This index is mapped in Data Model Macros.

I want to exclude all other indexes in (ep_winevt_ms*) and take the count as 1 to know the unique indexes.

ITWhisperer — Mon, 01 Apr 2024 07:37:05 GMT

| stats count by index | stats count