Could you help me with a couple questions I have about the eventcount search command?

[R_B]

Hi everyone,

I have a couple questions about using the eventcount command...

1.) I noticed that if you set summarize=false, the event count results will be split by index and search peer. Is there a way to split by just index and not by search peer as well? Meaning, split by index across all search peers?

2.) This might be more of a complicated question, but what happens behind the scenes when you run the eventcount search command? Meaning, from the moment I start an eventcount search to the moment the results are displayed, what's going on behind the scenes to get and display these results? What is Splunk (or I suppose it would be the splunkd process on linux?) doing to make this happen? Are there any scripts that are being used when you run this search?

Thanks in advanced for any help!

[martin_mueller · Accepted solution]

You can compute the sum over all peers by index yourself: | eventcount index=* summarize=false | stats sum(count) as count by index

eventcount is a built-in command, there are no scripts running. It's probably summing up the event counts listed in one of the .data files for every bucket in every index on every peer, and optionally the size in .rawSize when specified.
What behind-the-scenes info are you looking for? http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/eventcount

[R_B]

I didn't think about doing it that way, that's perfect, thank you!

Ok I see. I was most curious about how Splunk was getting the information, but as you explain its in the .data files and optionally the .rawSize files. Thanks for your help!