IT Operations Discussions
All the up-time. All the nines.

How do I know if I have multiple events

New Member

Because wc -l of the input doesn't match my event count, and I'm trying to troubleshoot.

0 Karma

Super Champion

look at field "linecount" in your events.

index=<yourindex> | where linecount>1
If this helps, give a like below.
0 Karma


Please describe the problem in more detail.  What kind of events, how are you counting them?

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...