Query for eventcount - Splunk Community

Splunk Search

I have a lookup file with indexes in it, I want a query i need the eventcount of the indexes mentioned in the lookup table for 24 hrs

This should get you going in the right direction.

| tstats count where [|inputlookup indexes.csv | fields index | format] by index

---
If this reply helps you, Karma would be appreciated.

hi @vijaysri

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventcount

Thanks
Harish

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...