Number of events indexed yesterday for an index

[peter_gianusso]

Simple one that I cannot find an answer to.

I would like to know the number of events indexed yesterday for the index ili_imaging_index

thanks

[Ayn · Accepted solution]

Simple (but inefficient) solution:

index=ili_imaging_index earliest=-1d@d latest=@d | stats count

Somewhat more complex but much faster solution: run this scheduled search at midnight every day:

| metadata type=hosts index=ili_imaging_index | stats sum(totalCount) as totalCount

Enable summary indexing for this search, then use the difference between the totalCount values for two consecutive days to calculate how many events were indexed.