Can one tell how much of the 16TB of my log data is being searched on any regular basis?

[khourihan_splun]

Can one tell how much of the 16TB of my log data is being searched on any regular basis?

[yannK]

It is hard to tell the actual volume searched, but you can have the count of the events searched each time.

index=_audit source=*audit* action=search scan_count | table _time user scan_count event_count result_count

• scan_count is how many events were explored based on the scoping conditions (index, timerange, sourcetype etc..)
• event_count is how many matched the search terms. (field condition, keywords ....)
• result_count is how many lines were returned after the processing