Splunk Search

How do check the number of events of an index?

perlish
Communicator

For example, I have added some other indexes, I want to know that whether the events have been sent into the corresponding index ?
And I also want to know that the NUMBER of events of that index?

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The easiest way is probably using eventcount:

| eventcount index=myindex

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventcount

Note that dbinspect is good, but will not work in a distributed cluster, thought it can be run independently on each indexer.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The easiest way is probably using eventcount:

| eventcount index=myindex

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventcount

Note that dbinspect is good, but will not work in a distributed cluster, thought it can be run independently on each indexer.

Ayn
Legend
0 Karma

martin_mueller
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...