https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40628#M9374 <P>Thanks, I solved my issue using this query:</P> <P>search earliest=-w | stats count</P> Tue, 21 May 2013 10:03:50 GMT RiccardoV 2013-05-21T10:03:50Z https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40625#M9371 <P>Hi,<BR /> i'm creating a dashboard with some general infos, showed as first dashboard to the user. <BR /> I have two distinct <STRONG>hiddensearch</STRONG> modules, both of them with this <STRONG>"search"</STRONG> param:</P> <P>" | eventcount | stats sum(count) as count"</P> <P>The second module has <STRONG>"earliest"</STRONG> param too, set to -w, to find just the events of the last week.<BR /> However, I retrieve always the same result for both research. I check the data, and I should have very different results.</P> <P>thanks in advance for your answers!</P> <P><STRONG>edit</STRONG>: now I'm using this query: </P> <P><STRONG>search earliest=-w | stats count</STRONG></P> <P>there is a better (and more efficient) way to get the same result?</P> Tue, 21 May 2013 09:07:01 GMT https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40625#M9371 RiccardoV 2013-05-21T09:07:01Z https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40626#M9372 <P>The eventcount command just returns the total amount of events in the index. The earliest parameter won't have an impact on this search.</P> Tue, 21 May 2013 09:33:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40626#M9372 abhutiani 2013-05-21T09:33:47Z https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40627#M9373 <P><CODE>eventcount</CODE> does not work with earliest/latest. It's a metadata command, and does not look at the events themselves (so it cannot determine timestamps).</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventcount">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventcount</A></P> <P>/k</P> Tue, 21 May 2013 09:36:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40627#M9373 kristian_kolb 2013-05-21T09:36:50Z https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40628#M9374 <P>Thanks, I solved my issue using this query:</P> <P>search earliest=-w | stats count</P> Tue, 21 May 2013 10:03:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-retrieve-the-number-of-all-events-logged-in-the-last-week/m-p/40628#M9374 RiccardoV 2013-05-21T10:03:50Z