Knowledge Management

Global summary - Events Indexed counter

Communicator

If the Events Indexed in the Global summary on the main summary page, if this number decreases, does that mean an index was deleted? What other reason would there be for a decrease in this number?

1 Solution

Splunk Employee
Splunk Employee

That field is populated by summing the counts of events for each sourcetype as found in the metadata.

This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.

View solution in original post

SplunkTrust
SplunkTrust

Most likely, this is because a Splunk index bucket was rolled from cold to frozen (and possibly deleted, depending on your configuration). As buckets age, they move from hot to warm to cold to frozen. The default action for moving to frozen is to delete the bucket. Your "events indexed" counter would then be reduced by the number of events in that bucket.

The docs cover this well at http://www.splunk.com/base/Documentation/4.2.1/Admin/HowSplunkstoresindexes

0 Karma

Splunk Employee
Splunk Employee

That field is populated by summing the counts of events for each sourcetype as found in the metadata.

This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.

View solution in original post

Communicator

Thanks bwooden, looks like the maxTotalDataSizeMB was set and some data rolled over to frozen.

0 Karma