Query for eventcount - Splunk Community

Splunk Search

I have a lookup file with indexes in it, I want a query i need the eventcount of the indexes mentioned in the lookup table for 24 hrs

This should get you going in the right direction.

| tstats count where [|inputlookup indexes.csv | fields index | format] by index

---
If this reply helps you, Karma would be appreciated.

hi @vijaysri

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventcount

Thanks
Harish

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...