Splunk Search

How to quickly count total events in an index?

muebel
SplunkTrust
SplunkTrust

Besides running "index=foo *" is there a way to quickly check the total number of events indexed in an index?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

ftk
Motivator

That's way slicker than | metadata type=hosts index=foo | stats sum(totalCount)...awesome.

0 Karma

bgagliardi1
Path Finder

I found this article just now because I wanted to do something similar, but i have dozens of indexes, and wanted a sum by index over X time.

index=* | chart count(index) by index | sort - count(index) | rename count(index) as "Sum of Events"

0 Karma

earlhelms
Path Finder

6 years later, thanks!

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...