Does anyone have a solution for a query that will return the daily event count of every index, index by index, even the ones that have ingested zero events?
| tstats count WHERE index=* OR index=_* by index ... only returns indexes that have > 0 events.
Run this search:
| tstats count WHERE index=* OR index=_* by index
| append [| rest /servicesNS/-/-/data/indexes count=0 | fields title | dedup title | rename title as index | eval count=0]
| stats sum(count) as count by index
I hope this helps!! Accept the answer if it does!!
Run this search:
| tstats count WHERE index=* OR index=_* by index
| append [| rest /servicesNS/-/-/data/indexes count=0 | fields title | dedup title | rename title as index | eval count=0]
| stats sum(count) as count by index
I hope this helps!! Accept the answer if it does!!
Perfect solution. Thank you so much!