How to find monitored csv files with more than a 100k rows?

[jiaqya]

Is there a log or a command output that I can use to determine the number of rows each CSV file that is being monitored has?

I am looking for this info so I can find out how many of the CSV files are more than 100k rows to resolve another issue that I am facing.

Thanks

[niketn · Accepted solution]

@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events

| tstats count where index=<yourIndexName> by source

OR

| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source

Following is a run anywhere search based on Splunk's _internal index for sourcetype=splunkd

| tstats count where index=_internal AND sourcetype=splunkd by source

[jiaqya]

This surely is one way, thanks.

john.