Global summary - Events Indexed counter

[gekoner]

If the Events Indexed in the Global summary on the main summary page, if this number decreases, does that mean an index was deleted? What other reason would there be for a decrease in this number?

[dwaddle]

Most likely, this is because a Splunk index bucket was rolled from cold to frozen (and possibly deleted, depending on your configuration). As buckets age, they move from hot to warm to cold to frozen. The default action for moving to frozen is to delete the bucket. Your "events indexed" counter would then be reduced by the number of events in that bucket.

The docs cover this well at http://www.splunk.com/base/Documentation/4.2.1/Admin/HowSplunkstoresindexes

[bwooden · Accepted solution]

That field is populated by summing the counts of events for each sourcetype as found in the metadata.

This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.

[gekoner]

Thanks bwooden, looks like the maxTotalDataSizeMB was set and some data rolled over to frozen.