What is the actual number of events?

[reedmohn]

When I look under "Manager->indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.
But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.

Am I reading this incorrectly, or could something else be up?

[reedmohn · Accepted solution]

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

[sdaniels]

Yep, i have a different set up so it was worth a try. I'm putting my answer in the comments so someone else can answer.

[reedmohn]

No, main the only one listed as default here. But I don't see that this factors in. The two sources mentioned are both stored in the main index. In fact, the largest one alone is 1.7bill according to the summary page...

[sdaniels]

For Splunk roles there is a setting for 'Indexes searched by default'. Manager > Access Controls > Roles. I think if you check there, you will see other indexes that are listed by default. Do you see more than just the 'main' index there?