REST endpoints /data/indexes and/data/indexes-exte...

thenhaque · ‎03-09-2018

I'm trying to obtain the total number of events stored in an index. However, using 2 REST endpoints give me two different results. Would anyone know why the difference and which number we should trust?

strive · ‎03-09-2018

indexes-extended data is updated periodically.
Usage details
The default update period is 10 minutes, as defined by the collectionPeriodInSecs attribute in the $SPLUNK_HOME/etc/apps/introspection_generator_addon/default/server.conf file.

REST endpoints /data/indexes and/data/indexes-extended give different number of event counts

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Are you a member of the Splunk Community?

REST endpoints /data/indexes and/data/indexes-extended give different number of event counts

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions