https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258135#M77327 <P>It's possible that your new indexer is collecting something that you aren't aware of, but it's hopefully some other machine and not your indexer. Run this search on the time range just before &amp; after you noticed the increase. (It could be a long search if you have a large environment, so you may want to run it in the background.)</P> <PRE><CODE>index=* | timechart span=1d count by host </CODE></PRE> <P>If you have a huge number of hosts then you may need to include the limit and useother parameters, too. </P> Tue, 12 Jul 2016 18:43:54 GMT lycollicott 2016-07-12T18:43:54Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258131#M77323 <P>For my data set, I am looking to see the sum of the number of events per distinct count of servers. Reasoning, I am looking at a data set that has a large increase in volume near increase in Splunk indexing servers. I wanted to see if the increase of Splunk indexers could be the cause of the increase in volume. Any additional insight is appreciated. </P> <P>Thanks in advance </P> Tue, 12 Jul 2016 18:25:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258131#M77323 wzgoda 2016-07-12T18:25:01Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258132#M77324 <P>Do you mean that you added a new indexer to an indexer cluster and at the same time you noticed that you were indexing a greater number of events?</P> Tue, 12 Jul 2016 18:31:55 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258132#M77324 lycollicott 2016-07-12T18:31:55Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258133#M77325 <P>close.... I added a new indexer and after a short period of time the volume increased. My boss is grilling me for the ration of events per server over time so I just want to get that for her. </P> Tue, 12 Jul 2016 18:34:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258133#M77325 wzgoda 2016-07-12T18:34:03Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258134#M77326 <P>Try like this</P> <PRE><CODE>index=* | timechart span=1d count by splunk_server limit=0 useother=f | addtotals </CODE></PRE> Tue, 12 Jul 2016 18:37:28 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258134#M77326 somesoni2 2016-07-12T18:37:28Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258135#M77327 <P>It's possible that your new indexer is collecting something that you aren't aware of, but it's hopefully some other machine and not your indexer. Run this search on the time range just before &amp; after you noticed the increase. (It could be a long search if you have a large environment, so you may want to run it in the background.)</P> <PRE><CODE>index=* | timechart span=1d count by host </CODE></PRE> <P>If you have a huge number of hosts then you may need to include the limit and useother parameters, too. </P> Tue, 12 Jul 2016 18:43:54 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258135#M77327 lycollicott 2016-07-12T18:43:54Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258136#M77328 <P>Some extra (and possibly faster) fun searches:</P> <PRE><CODE>| tstats prestats=t count WHERE index=* BY _time host span=1d | timechart span=1d count by host </CODE></PRE> <P>If you needed that by indexer, you can try something like:</P> <PRE><CODE>| tstats prestats=t count WHERE index=* BY _time splunk_server span=1d | timechart span=1d count by splunk_server </CODE></PRE> Tue, 12 Jul 2016 20:14:42 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-show-the-number-of-events-per-distinct-count/m-p/258136#M77328 dshpritz 2016-07-12T20:14:42Z