How to return the daily event count of every index?

[gazoscreek]

Does anyone have a solution for a query that will return the daily event count of every index, index by index, even the ones that have ingested zero events?

| tstats count WHERE index=* OR index=_* by index ... only returns indexes that have > 0 events.

[VatsalJagani · Accepted solution]

Run this search:

| tstats count WHERE index=* OR index=_* by index
| append [| rest /servicesNS/-/-/data/indexes count=0 | fields title | dedup title | rename title as index | eval count=0]
| stats sum(count) as count by index

I hope this helps!! Accept the answer if it does!!

[gazoscreek]

Perfect solution. Thank you so much!