https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470230#M1054 <P>AFTER going through the fundamentals of splunk 1 course, I installed splunk and uploaded all the 3 data sets into splunk. But then i checked the the count of events indexed before logging out as it is instructruted in the pdf from the course. And later i logged out and logged in again. Then saw a different count of the events indexed. Why like that? Can anyone please explain....</P> Sat, 26 Oct 2019 17:50:00 GMT ssv24 2019-10-26T17:50:00Z https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470230#M1054 <P>AFTER going through the fundamentals of splunk 1 course, I installed splunk and uploaded all the 3 data sets into splunk. But then i checked the the count of events indexed before logging out as it is instructruted in the pdf from the course. And later i logged out and logged in again. Then saw a different count of the events indexed. Why like that? Can anyone please explain....</P> Sat, 26 Oct 2019 17:50:00 GMT https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470230#M1054 ssv24 2019-10-26T17:50:00Z https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470231#M1055 <P>Events do not stay forever; depending on the settings in <CODE>indexes.conf</CODE> and the amount of disk space available, the events will be automatically deleted.</P> Sat, 26 Oct 2019 21:48:33 GMT https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470231#M1055 woodcock 2019-10-26T21:48:33Z https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470232#M1056 <P>yeah. Ok but the count increased after logging out and logging in again. Why?</P> Sun, 27 Oct 2019 07:33:38 GMT https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470232#M1056 ssv24 2019-10-27T07:33:38Z https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470233#M1057 <P>Probably you were using a <CODE>Time picker</CODE> value like <CODE>Last 4 hours</CODE> which gradually shifts events beyond the matching timeframe as time marches forward but then you logged in again and selected a different longer value like <CODE>All time</CODE> which covered all the events regardless of how old they are.</P> Mon, 28 Oct 2019 01:59:37 GMT https://community.splunk.com/t5/Training-Certification/ABOUT-OF-NUMBER-OF-EVENTS-INDEXED/m-p/470233#M1057 woodcock 2019-10-28T01:59:37Z