Getting Data In
Highlighted

How to make sure that the data forwarded is loading in the searchhead/indexer completely?

Influencer

I have a forwarder installed on a server and I am extracting the data for indexes like Name,Class etc and while extracting I am also storing extraction information as shown below in extraction_audit index. This index also forwarded to indexer along with indexes Name, Class,Place so on.

index...............beginextractiontime......endextractiontime......totalrecordsextracted
Name ...............1457452861....................... ..145745287..........................150
Class................1457453260..........................1457453290........................100
School_details..1457453564..........................1457453575.........................25
Place................1457453612 .........................1457453620 ........................50
Other................1457453734..........................1457453744.........................10
Name................1457453892..........................1457453895.........................25
Place................1457454094..........................1457454096..........................5

Now how can I check in search heads count by index is same as totalrecordsextracted between beginextractiontime and endextractiontime.

For Example for index=Name between 1457452861 and 145745287, how to check count by index is equal or not equal to totalrecordsextracted which is in index=extraction_audit.

0 Karma
Highlighted

Re: How to make sure that the data forwarded is loading in the searchhead/indexer completely?

SplunkTrust
SplunkTrust

Hello,

This should work:

index=name _index_earliest=1457452861 _index_latest=145745287

Thanks,
Michael

0 Karma
Highlighted

Re: How to make sure that the data forwarded is loading in the searchhead/indexer completely?

SplunkTrust
SplunkTrust

if you want to do it all in one search...

index=name _index_earliest=1457452861 _index_latest=145745287 | stats c AS count1 | appendcols [search index=extraction_audit  _index_earliest=1457452861 _index_latest=145745287 | stats c AS count2] | eval matching=if(count1=count2,"True","False") | table count1, count2, matching | rename count1 as "Indexed Event Count", count2 as "Audited Event Count"
0 Karma