IT Operations Discussions
All the up-time. All the nines.

How do I know if I have multiple events

marianaduran
New Member

Because wc -l of the input doesn't match my event count, and I'm trying to troubleshoot.

0 Karma

thambisetty
Super Champion

look at field "linecount" in your events.

index=<yourindex> | where linecount>1
————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please describe the problem in more detail.  What kind of events, how are you counting them?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...