Monitoring Splunk
Highlighted

Number of results returned by searches

Splunk Employee
Splunk Employee

We are building a dashboard displaying information on Splunk Performance.

One panel shows the number of searches that were run on any particular moment.

index=_audit host=searchhead* search!="" | timechart count by host

Is there a way to get the total number of results that were returned for each of those searches? Actually just want to know the total numbers of results that were returned during that time.

Tags (2)
0 Karma
Highlighted

Re: Number of results returned by searches

Splunk Employee
Splunk Employee

Found the query I needed.

index=_audit host=searchhead* info=completed | timechart sum(event_count) by host

View solution in original post

0 Karma