Splunk Search

What is the actual number of events?

reedmohn
Communicator

When I look under "Manager->indexes", I see that my "main" index is about half full (240 of 500 GB), and the number of events approx 1.455 billion.
But in the search app summary page, the two largest sources alone have a count that adds up to 1.95 billion.

Am I reading this incorrectly, or could something else be up?

Tags (2)
0 Karma
1 Solution

reedmohn
Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

View solution in original post

0 Karma

reedmohn
Communicator

Just figured this one out myself: I /was/ reading it incorrectly. I forgot that the indexer only show it's own events, while the search interface on it is in fact a search head for both our indexers.

So all the "missing" data were on indexer #2.....

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Yep, i have a different set up so it was worth a try. I'm putting my answer in the comments so someone else can answer.

0 Karma

reedmohn
Communicator

No, main the only one listed as default here. But I don't see that this factors in. The two sources mentioned are both stored in the main index. In fact, the largest one alone is 1.7bill according to the summary page...

0 Karma

sdaniels
Splunk Employee
Splunk Employee

For Splunk roles there is a setting for 'Indexes searched by default'. Manager > Access Controls > Roles. I think if you check there, you will see other indexes that are listed by default. Do you see more than just the 'main' index there?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...