Splunk Search

Stats Around Events and Sources

andrewkenth
Communicator

Is there an internal search I can run that will return the number of events loaded to date and number of files (sources) loaded to date?

I can obviously run searches similar to what I have below and accelerate them but I was wondering if there was a better way to do it.

 ... | stats count first(_time) by source | stats count(source)

or

.... | stats count first(_time) by source
Tags (3)
0 Karma
1 Solution

linu1988
Champion

Hello,
You may get that from the metadata command.

|metadata type=sources

will provide you all the sources from where you got the events

|metadata type=sources|stats sum(totalCount) as "Total Events"

Provides you the total number of events till date

Thanks

View solution in original post

0 Karma

linu1988
Champion

Hello,
You may get that from the metadata command.

|metadata type=sources

will provide you all the sources from where you got the events

|metadata type=sources|stats sum(totalCount) as "Total Events"

Provides you the total number of events till date

Thanks

0 Karma

somesoni2
Revered Legend

Another option for total events counts across all indexes:

| eventcount summarize=false index=* |stats sum(count) as TotalEvents

For total no of files loaded
|metadata type=sources | stats count

combined
| eventcount summarize=false index=* |stats sum(count) as TotalEvents | appendcols [|metadata type=sources | stats count as TotalFiles]

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...