Is there a log or a command output that I can use to determine the number of rows each CSV file that is being monitored has?
I am looking for this info so I can find out how many of the CSV files are more than 100k rows to resolve another issue that I am facing.
Thanks
@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events
| tstats count where index=<yourIndexName> by source
OR
| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source
Following is a run anywhere search based on Splunk's _internal
index for sourcetype=splunkd
| tstats count where index=_internal AND sourcetype=splunkd by source
@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events
| tstats count where index=<yourIndexName> by source
OR
| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source
Following is a run anywhere search based on Splunk's _internal
index for sourcetype=splunkd
| tstats count where index=_internal AND sourcetype=splunkd by source
This surely is one way, thanks.
john.