Query for eventcount - Splunk Community

Splunk Search

I have a lookup file with indexes in it, I want a query i need the eventcount of the indexes mentioned in the lookup table for 24 hrs

This should get you going in the right direction.

| tstats count where [|inputlookup indexes.csv | fields index | format] by index

---
If this reply helps you, Karma would be appreciated.

hi @vijaysri

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventcount

Thanks
Harish

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...