Splunk Search

Can one tell how much of the 16TB of my log data is being searched on any regular basis?

khourihan_splun
Splunk Employee
Splunk Employee

Can one tell how much of the 16TB of my log data is being searched on any regular basis?

Tags (3)

yannK
Splunk Employee
Splunk Employee

It is hard to tell the actual volume searched, but you can have the count of the events searched each time.

index=_audit source=*audit* action=search scan_count | table _time user scan_count event_count result_count

  • scan_count is how many events were explored based on the scoping conditions (index, timerange, sourcetype etc..)
  • event_count is how many matched the search terms. (field condition, keywords ....)
  • result_count is how many lines were returned after the processing
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...