Hello, I am interested in finding the meaning of the following fields?
(1) event_count
(2) result_count
(3) available_count
(4) scan_count
(5) drop_count
Example is below.
Audit:[timestamp=02-03-2018 00:00:35.896, user=zops, action=search, info=canceled, search_id='1517615960.185830_86974EF3-D4A7-4683-B69E-19206AFBB708', total_run_time=0.40, event_count=0, result_count=0, available_count=0, scan_count=157, drop_count=0, exec_time=1517615960, api_et=1517615060.000000000, api_lt=1517615960.000000000, search_et=1517615700.000000000, search_lt=1517615880.000000000, is_realtime=0, savedsearch_name="", search_startup_time="305", searched_buckets=236, eliminated_buckets=115, considered_events=157, total_slices=3905957, decompressed_slices=101][n/a]
I believe these are some of the fields that are also available as properties through the Job Inspector. Docs: http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/ViewsearchjobpropertieswiththeJobInspector
For the terms you asked about in particular:
In other words, if I run a search, the number of events read off of disk for my search is scan_count
, but the number of events that qualify for my search is event_count
.
result_count could be the same as event_count if I was just retrieving events, but if I did some form of statistics, in my search that could be different. ( For example if my search ended with | stats count
, result_count
would be 1). available_count
would be more than zero if I was able to export any events (i.e. if I had events, and I was doing a non-transforming search, or I was running in verbose mode ).
I believe these are some of the fields that are also available as properties through the Job Inspector. Docs: http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/ViewsearchjobpropertieswiththeJobInspector
For the terms you asked about in particular:
In other words, if I run a search, the number of events read off of disk for my search is scan_count
, but the number of events that qualify for my search is event_count
.
result_count could be the same as event_count if I was just retrieving events, but if I did some form of statistics, in my search that could be different. ( For example if my search ended with | stats count
, result_count
would be 1). available_count
would be more than zero if I was able to export any events (i.e. if I had events, and I was doing a non-transforming search, or I was running in verbose mode ).