Getting Data In

How to find monitored csv files with more than a 100k rows?

Builder

Is there a log or a command output that I can use to determine the number of rows each CSV file that is being monitored has?

I am looking for this info so I can find out how many of the CSV files are more than 100k rows to resolve another issue that I am facing.

Thanks

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events

| tstats count where index=<yourIndexName> by source

OR

| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source

Following is a run anywhere search based on Splunk's _internal index for sourcetype=splunkd

| tstats count where index=_internal AND sourcetype=splunkd by source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

SplunkTrust
SplunkTrust

@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events

| tstats count where index=<yourIndexName> by source

OR

| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source

Following is a run anywhere search based on Splunk's _internal index for sourcetype=splunkd

| tstats count where index=_internal AND sourcetype=splunkd by source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Builder

This surely is one way, thanks.

john.

0 Karma