I have a need to count the number of events ingested for 2024.

[paulcurry]

I would like to get a count of events of all data ingested for 2024.  I have hundreds of indexes and all data over 90 days goes to DDAA.  I can use "eventcounts" for the searchable data and just multiply by 4 for an estimate.  

Using: 

| eventcount summarize=false index=*
| stats sum(count) as total_events by index
| fieldformat total_events=tostring(total_events,"commas")
| addcoltotals

Is there a way to get eventcounts for archived data?

[paulcurry]

That's what I thought.  Thank you for confirming.

[richgalloway · Accepted solution]

Archived data must be restored before it can be searched.