Splunk Search

Could you help me with a couple questions I have about the eventcount search command?

R_B
Path Finder

Hi everyone,

I have a couple questions about using the eventcount command...

1.) I noticed that if you set summarize=false, the event count results will be split by index and search peer. Is there a way to split by just index and not by search peer as well? Meaning, split by index across all search peers?

2.) This might be more of a complicated question, but what happens behind the scenes when you run the eventcount search command? Meaning, from the moment I start an eventcount search to the moment the results are displayed, what's going on behind the scenes to get and display these results? What is Splunk (or I suppose it would be the splunkd process on linux?) doing to make this happen? Are there any scripts that are being used when you run this search?

Thanks in advanced for any help!

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can compute the sum over all peers by index yourself: | eventcount index=* summarize=false | stats sum(count) as count by index

eventcount is a built-in command, there are no scripts running. It's probably summing up the event counts listed in one of the .data files for every bucket in every index on every peer, and optionally the size in .rawSize when specified.
What behind-the-scenes info are you looking for? http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/eventcount

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can compute the sum over all peers by index yourself: | eventcount index=* summarize=false | stats sum(count) as count by index

eventcount is a built-in command, there are no scripts running. It's probably summing up the event counts listed in one of the .data files for every bucket in every index on every peer, and optionally the size in .rawSize when specified.
What behind-the-scenes info are you looking for? http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/eventcount

R_B
Path Finder

I didn't think about doing it that way, that's perfect, thank you!

Ok I see. I was most curious about how Splunk was getting the information, but as you explain its in the .data files and optionally the .rawSize files. Thanks for your help!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...