Query for eventcount - Splunk Community

Splunk Search

I have a lookup file with indexes in it, I want a query i need the eventcount of the indexes mentioned in the lookup table for 24 hrs

This should get you going in the right direction.

| tstats count where [|inputlookup indexes.csv | fields index | format] by index

---
If this reply helps you, Karma would be appreciated.

hi @vijaysri

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventcount

Thanks
Harish

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...