Archive

What is the actual number of events?

Communicator

When I look under "Manager->indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.
But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.

Am I reading this incorrectly, or could something else be up?

Tags (2)
0 Karma
1 Solution

Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

View solution in original post

0 Karma

Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Yep, i have a different set up so it was worth a try. I'm putting my answer in the comments so someone else can answer.

0 Karma

Communicator

No, main the only one listed as default here. But I don't see that this factors in. The two sources mentioned are both stored in the main index. In fact, the largest one alone is 1.7bill according to the summary page...

0 Karma

Splunk Employee
Splunk Employee

For Splunk roles there is a setting for 'Indexes searched by default'. Manager > Access Controls > Roles. I think if you check there, you will see other indexes that are listed by default. Do you see more than just the 'main' index there?

0 Karma