Splunk Search

I have a need to count the number of events ingested for 2024.

paulcurry
Path Finder

I would like to get a count of events of all data ingested for 2024.  I have hundreds of indexes and all data over 90 days goes to DDAA.  I can use "eventcounts" for the searchable data and just multiply by 4 for an estimate.  

Using: 

| eventcount summarize=false index=*
| stats sum(count) as total_events by index
| fieldformat total_events=tostring(total_events,"commas")
| addcoltotals

 

Is there a way to get eventcounts for archived data?

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Archived data must be restored before it can be searched.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

paulcurry
Path Finder

That's what I thought.  Thank you for confirming.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Archived data must be restored before it can be searched.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...