Splunk Search

Could you help me with a couple questions I have about the eventcount search command?

R_B
Path Finder

Hi everyone,

I have a couple questions about using the eventcount command...

1.) I noticed that if you set summarize=false, the event count results will be split by index and search peer. Is there a way to split by just index and not by search peer as well? Meaning, split by index across all search peers?

2.) This might be more of a complicated question, but what happens behind the scenes when you run the eventcount search command? Meaning, from the moment I start an eventcount search to the moment the results are displayed, what's going on behind the scenes to get and display these results? What is Splunk (or I suppose it would be the splunkd process on linux?) doing to make this happen? Are there any scripts that are being used when you run this search?

Thanks in advanced for any help!

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can compute the sum over all peers by index yourself: | eventcount index=* summarize=false | stats sum(count) as count by index

eventcount is a built-in command, there are no scripts running. It's probably summing up the event counts listed in one of the .data files for every bucket in every index on every peer, and optionally the size in .rawSize when specified.
What behind-the-scenes info are you looking for? http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/eventcount

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can compute the sum over all peers by index yourself: | eventcount index=* summarize=false | stats sum(count) as count by index

eventcount is a built-in command, there are no scripts running. It's probably summing up the event counts listed in one of the .data files for every bucket in every index on every peer, and optionally the size in .rawSize when specified.
What behind-the-scenes info are you looking for? http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/eventcount

R_B
Path Finder

I didn't think about doing it that way, that's perfect, thank you!

Ok I see. I was most curious about how Splunk was getting the information, but as you explain its in the .data files and optionally the .rawSize files. Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...