Splunk Search

What is the actual number of events?

reedmohn
Communicator

When I look under "Manager->indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.
But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.

Am I reading this incorrectly, or could something else be up?

Tags (2)
0 Karma
1 Solution

reedmohn
Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

View solution in original post

0 Karma

reedmohn
Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yep, i have a different set up so it was worth a try. I'm putting my answer in the comments so someone else can answer.

0 Karma

reedmohn
Communicator

No, main the only one listed as default here. But I don't see that this factors in. The two sources mentioned are both stored in the main index. In fact, the largest one alone is 1.7bill according to the summary page...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

For Splunk roles there is a setting for 'Indexes searched by default'. Manager > Access Controls > Roles. I think if you check there, you will see other indexes that are listed by default. Do you see more than just the 'main' index there?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...