I have a report running the following search:
| REST /services/data/indexes | WHERE substr(title,1,1)!="_" | dedup title |table title totalEventCount currentDBSizeMB minTime maxTime |sort -totalEventCount -currentDBSizeMB title
Last Friday we upgraded to the most recent version of Splunk, and two days ago our admin team added storage on two Index servers. Now all but two of my indexes report as having only a single event in them. In fact, both totalEventCount and currentDBSizeMB return a value of 1 for all but two indexes. Even on the two indexes that do return higher counts, the numbers are MUCH lower than they should be. I don't know if the Splunk version upgrade or the addition of storage caused my counts to change. They may be completely unrelated.
My question is how can I fix the counts coming from the REST service?
