Simple one that I cannot find an answer to.
I would like to know the number of events indexed yesterday for the index ili_imaging_index
Simple (but inefficient) solution:
index=ili_imaging_index earliest=-1d@d latest=@d | stats count
Somewhat more complex but much faster solution: run this scheduled search at midnight every day:
| metadata type=hosts index=ili_imaging_index | stats sum(totalCount) as totalCount
Enable summary indexing for this search, then use the difference between the totalCount values for two consecutive days to calculate how many events were indexed.
View solution in original post